Cyber & ISO · Led by practising lead auditors
ISO 27001 Readiness Assessment & Gap Analysis
Every clause of the standard and all 93 Annex A controls, assessed against evidence by practising lead auditors in one to two weeks. It ends in a costed, sequenced plan and a board walkthrough, and it prices the whole journey: our fees, your internal effort and the certification body, before anyone commits to anything.
The assessment at a glance
Definition
What is an ISO 27001 readiness assessment?
An ISO 27001 readiness assessment, also called a gap analysis, measures everything the standard requires against what your organisation runs: every clause, all 93 Annex A controls, the evidence behind each answer and the people who own the controls. It ends in a costed, sequenced plan to close the gaps, so the decision to pursue certification is made on numbers rather than optimism.
Intelance delivers it in one to two weeks for a fixed fee from £8,500 + VAT, using practising lead auditors who know exactly what Stage 1 and Stage 2 will test. The report prices the whole journey: implementation from £25,000 if you proceed, your internal effort, and the certification body fees of £4,000 to £12,000 across the three year cycle.
If you want a first read before committing, the free ISO 27001 and ISO 42001 readiness checker scores the clauses auditors test in about six minutes, with no email address required.
Some organisations stop after the assessment, and that is the assessment doing its job. Our readiness checklist shows what gets measured, and the wider practice is described under ISO 27001 consulting.
Every clause and every control
The full standard and all 93 Annex A controls, with nothing sampled out.
Evidence over answers
Controls tested against evidence, because Stage 2 will do exactly that.
Costed and sequenced
A plan with numbers and an order, ready for a budget holder.
Walked through with your board
Findings presented to the people who will fund the fix.
The failure modes
Six places certification fails before it starts
Stage 2 failures are rarely surprises to the auditor. They were visible months earlier. Each card shows what the assessment finds while it is still cheap to fix.
Scope games
A scope drawn to dodge the hard systems, which certification bodies unpick in the first hour of Stage 1.
Found hereThe scope tested against how the business runs, and redrawn honestly.The paper ISMS
Policies written, folder tidy, nothing operating. Documents describe a system. They are not the system.
Found hereThe gap between what is written and what runs, measured clause by clause.Risk theatre
A register built once for an auditor, scored by gut feel, and never used to make a single decision.
Found hereWhether the risk process would survive being repeated by your own team.The evidence vacuum
Controls that exist but cannot be proven: no minutes, no logs, no record of any decision.
Found hereThe evidence trail tested per control, exactly as Stage 2 will test it.Unowned controls
Every control assigned to IT in general, which means assigned to nobody in particular.
Found hereNamed owners checked against real diaries, so ownership means something.False confidence
A previous consultant said nearly ready, a certificate elsewhere implied it transfers, the team feels sure. Sureness is not evidence.
Found hereAn independent number: how far you are, and what closing it costs.How it works
What happens across the ten days
The assessment runs to a published rhythm, so you know what is happening on every one of the ten days.
Evidence request
A precise request list, so the assessment measures the estate rather than the tidiness of the folder.
Documentation and interviews
Every clause reviewed, and the people who own the controls interviewed, specifically and without theatre.
Control testing
All 93 Annex A controls tested against evidence, exactly as a certification body will test them.
Costing and sequencing
Findings turned into a plan with numbers and an order: what to fix, in what sequence, at what cost.
Board walkthrough
The findings and the whole cost of the journey presented to the people who will fund it.
Smaller scopes finish inside a week. Complex and multi site scopes take the full two, and we say which on the first call. The findings feed ISMS Foundations directly, so nothing is assessed twice.
Published fees
What the assessment usually uncovers next
Every route out of the report is priced here, before you ask. Some organisations stop at the report, and that is a legitimate outcome.
ISMS Foundations & Implementation
The end to end build the assessment prices: scope, risk machinery, SoA, controls and an operating rhythm, running before Stage 1.Best whenThe decision is yes and a deadline exists. FeeFrom £25,000 + VAT3 to 6 months 02
ISO 27001 Internal Audit
The mandatory internal audit by qualified lead auditors, so problems surface while there is still time to fix them.Best whenAn ISMS already exists and Stage 2 or surveillance is coming. FeeFrom £4,500 + VAT1 to 2 weeks 03
Managed ISMS
Reviews, policy updates, internal audits and audit season handled month by month, because the hardest part is staying certified.Best whenThe certificate exists and the diary space does not. FeeFrom £2,500 + VAT / month 04ISO 27001 Consulting
The whole practice from gap to certificate to managed operation, led by practising lead auditors with every fee published.Best whenYou want the full picture before choosing an entry point. FeeEvery fee publishedFixed by scope
The alternatives
Gap assessment, internal audit and certification audit compared
Three different exercises that get confused constantly, and buying the wrong one wastes weeks. This is which is which.
Does the ISMS meet the standard and its own rules? The mandatory annual check.
At least annually, once an ISMS exists
Qualified auditors: internal, or outsourced from £4,500 + VAT
Stage 2 or a surveillance audit is coming
Does the organisation earn or keep the certificate? The formal Stage 1 and Stage 2.
At the end of the route, then surveillance in years two and three
A UKAS accredited certification body, £4,000 to £12,000 across three years
The system is built, run and evidenced
How far are we from ready, and what does closing the distance cost?
Before anything is committed: the first step from cold
Practising lead auditors, from £8,500 + VAT fixed
You are starting cold, or working from a guess
Scope
What the fee covers and what sits outside it
You get
Every clause and all 93 controls assessed against evidence, exactly as Stage 2 will test them.
A costed, sequenced plan a budget holder can act on the same week.
The whole journey priced: our fees, your internal effort and the certification body together.
Walked through with your board, so the decision is made by the people funding it.
Findings that carry: the plan feeds ISMS Foundations directly, with nothing assessed twice.
This is not
The internal audit. That is the separate, mandatory exercise once an ISMS exists, from £4,500 + VAT.
A sales funnel. When the honest finding is do not pursue certification yet, the report says so and the spend stops.
A questionnaire. Controls are tested against evidence rather than self declared over a call.
A generic maturity score. Every finding maps to a clause or control, with a cost and a place in the sequence.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to a lead auditor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
Practising lead auditors
The assessment is run by people who audit against ISO 27001 for a living, so it tests what Stage 1 and Stage 2 will test.
Priced for closing
Every finding is costed and sequenced, so the report is a plan a budget holder can act on rather than a verdict to file.
The whole number
Our fees, your internal effort and the certification body’s £4,000 to £12,000 across three years, stated together before you commit.
Honest about stopping
Some organisations should not pursue certification yet, and some should take Cyber Essentials instead. When that is the finding, the report says so.
Findings that carry
The assessment feeds ISMS Foundations directly: the same team, the same evidence, nothing rebuilt.
The people behind the work
Every assessment is led by a practising lead auditor, with senior consultants on the interviews and testing. Nothing is offshored and nothing is templated.
ISO 27001 guides
All insights
ISO 27001ISO 27001 cost UK: what certification really costs (2026)
The real components of ISO 27001 cost in the UK: consultancy fees, certification body charges over the three year cycle, internal time, ongoing running costs, and where budgets quietly drift.
10 July 2026 · 6 min read Read the guide
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min read
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
9 July 2026 · 6 min read
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min readReady to talk?
Get the whole number first
Thirty minutes with a lead auditor on who is asking, the deadline and what exists today. Two weeks later you have the costed answer, and the decision gets made on numbers rather than optimism.
FAQs
Questions about the readiness assessment
What is an ISO 27001 readiness assessment?
A structured measurement of everything ISO/IEC 27001:2022 requires against what your organisation runs: every clause, all 93 Annex A controls, the evidence behind each answer and the ownership of every control. It ends in a costed, sequenced plan and a board walkthrough, so the certification decision is made on numbers.
Is a readiness assessment the same as an ISO 27001 gap analysis?
Yes. Readiness assessment, gap analysis, gap assessment and readiness audit all describe the same exercise. Whatever the name, the tests that matter are coverage (every clause and control), method (evidence rather than self declaration) and output (a costed plan rather than a score).
How much does an ISO 27001 readiness assessment cost?
From £8,500 + VAT with Intelance, fixed and agreed in writing before day one. For context on the whole journey: implementation programmes run from £25,000, internal audits from £4,500, and certification body fees add £4,000 to £12,000 across the three year cycle. The report states all of it together.
How long does it take?
One to two weeks. Smaller scopes finish inside a week. Complex and multi site scopes take the full two, and we say which on the first call. The published rhythm runs from evidence request on day one to the board walkthrough on day ten.
What does it cover?
Every clause of ISO/IEC 27001:2022 and all 93 Annex A controls, tested against evidence: documents reviewed, control owners interviewed, and the trail checked exactly as a certification body will check it at Stage 2. Nothing is sampled out.
How is this different from an internal audit?
The internal audit is a mandatory check of an ISMS that already exists, against both the standard and your own rules. The readiness assessment comes earlier: it measures the distance to ready from wherever you are, prices the journey and sequences the work. Buying one when you need the other wastes weeks.
What is in the report?
A finding for every clause and control, each mapped to what Stage 1 or Stage 2 would say about it, a prioritised and costed remediation roadmap, the whole cost of the journey including certification body fees, and a walkthrough with your board. It is written to be acted on, and it feeds implementation directly.
Can the assessment conclude we should not certify?
Yes, and sometimes it does. Where the cost outweighs the commercial demand, or Cyber Essentials answers the actual ask, the report says so and the spend stops. An assessment that can only ever recommend proceeding is a sales document.
What happens after the assessment?
Whatever the numbers justify. Most organisations proceed into ISMS Foundations from £25,000 + VAT with the findings carried straight in. Some fix the gaps internally against the roadmap. Some stop. All three are legitimate outcomes of a report built on evidence.