Legal & Compliance
ISO 27001 gap analysis: tick the checklist, then map your evidence
Start free on this page: tick the clause and Annex A checklist, with no account and no upload. When your evidence is ready, the mapper matches your files to your own control list and lists missing owners and overdue reviews.
Step 2 · Evidence mapper (AI job)
or drop them here
3 credits per job · 1 credit = 1 small AI job · Pro: 40 credits a month · packs from €6.99
What the evidence mapper gives you
CTRL-07: Access reviews occur quarterly. Evidence policy/access-review.md: Owner is Security Operations; last review 2027-06-30.
- Customer control: CTRL-07
- Evidence owner: Security Operations
Control-evidence workbook, stale/missing CSVs and evidence HTML
In the download
- A workbook that lists the evidence found for each control
- A CSV of stale evidence, older than the day limit you set
- A CSV of missing evidence, including files with no review date
- An HTML evidence view that quotes the passage and file path behind each match, with a confidence value
Before you upload
- Your control list as a CSV. It is required, because the standard text is copyrighted and not included here. The CSV template gives you the columns and 12 starter lines.
- Evidence as CSV, XLSX, PDF or DOCX. One job takes up to 30 control rows and 64,000 extracted characters.
- A free account and 3 credits per job, shown before you start
- Sources are encrypted and the result is kept for 24 hours
From checklist to evidence workbook
- 1
Find your gaps
Tick the checklist above. Each unticked line is something to collect evidence for.
- 2
Write your control list
Download the CSV template and fill it with the control wording you are licensed to use. One job takes up to 30 rows.
- 3
Upload and set the age limit
Add the control CSV and your evidence, then choose after how many days evidence counts as stale.
- 4
Check each match
Open the quoted passages, accept or reject each mapping, then download the package.
What the result does and does not tell you
Mapping happens only against the controls you upload, and no missing requirements are filled in from the standard. Evidence with no review date is listed as missing, not treated as current. Every mapping is a suggestion that an auditor accepts or rejects. A clean report does not mean you are certified. Certification comes from an accredited body after an audit.
Questions before you run it
Can I do an ISO 27001 gap analysis here for free?
Yes, with the checklist at the top of this page. It covers clauses 4 to 10 and the four Annex A themes, runs in your browser and needs no account. The evidence mapper is an AI job: it needs a free account and 3 credits per job.
Do I need to supply the control text myself?
Yes. The licensed control checklist CSV is required, because the standard text is copyrighted and is not bundled here. Mapping happens only against the controls you upload. The CSV template on this page gives you the columns and 12 starter lines in our own wording.
How does it decide that a document is evidence for a control?
It matches your evidence files and notes against your control wording, then quotes the passage and path it used together with a confidence value. Every mapping is a suggestion for an auditor to accept or reject.
What makes a piece of evidence count as stale?
The age threshold you set under Flag evidence older than days. Anything with a last-review date beyond it lands in the stale CSV, and evidence carrying no date at all is reported as missing rather than assumed current.
Does a clean report mean we are certified?
No. Certification comes from an accredited certification body after an audit. This output is preparation material that shows where evidence, owners and review dates are missing.
What can I upload and how much per run?
CSV, XLSX, PDF or DOCX, up to 30 control rows and 64,000 extracted characters per job. Larger control sets go through in batches. Each job needs a free account and costs 3 credits.