ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A gap analysis remediation plan is what separates a useful gap assessment from an expensive report that sits in a folder. The assessment tells you where you fall short of a standard or regulation. The plan tells you who will fix each shortfall, in what order, by when and how you will know it is fixed. Many organizations finish the assessment with real energy and lose it within a month because nobody converted the findings into work.
This guide shows how to turn findings into a plan that gets done: the fields it needs, how to prioritize, how to set realistic owners and dates, how to fix causes rather than symptoms, and how to prove that each item is closed.
The plan sits between two documents. The gap assessment lists findings against a set of requirements, whether that is ISO 27001, ISO 9001, GDPR or another framework. The audit or review that follows tests whether you have met those requirements. The gap analysis remediation plan connects them by turning each finding into one or more actions with accountability and evidence.
Good plans are short on prose and long on structure. Every finding should be traceable to an action, and every action should be traceable to evidence of completion. If you cannot follow that chain for a finding, an auditor cannot either. Our guides to ISO 27001 gap analysis, ISO 22301 gap analysis and GDPR gap analysis cover the assessment step for those frameworks.
| # | Field | What to record |
|---|---|---|
| 1 | Finding ID | A reference that links back to the gap assessment |
| 2 | Requirement | The clause, control or article that is not yet met |
| 3 | Gap description | What is missing or weak, in plain language |
| 4 | Severity | Rating for the consequence of leaving it open |
| 5 | Root cause | Why the gap exists, not just what it looks like |
| 6 | Action | The specific work that will close it |
| 7 | Owner | One named person accountable for completion |
| 8 | Due date | A realistic date agreed with the owner |
| 9 | Closure evidence | The document, record or test result that proves completion |
| 10 | Status and verification | Open, in progress, done or verified, and who checked |
A vague action such as “improve supplier management” cannot be closed. A precise one can: “approve a supplier risk assessment procedure and complete assessments for the ten critical suppliers by 30 June”. Each action should start with a verb, name the deliverable and say what done looks like. If an action takes more than a few weeks, split it into steps, each with its own date, so progress is visible and slippage is caught early.
Not every finding deserves the same urgency. Prioritize on two axes, severity and effort, and then apply a few overrides.
Then adjust for dependencies and deadlines. If a certification audit or a regulatory date is approaching, anything that blocks that milestone moves up, such as mandatory documents, an internal audit and a management review. If one action must happen before another, sequence them and show the dependency. For the certification standard behind many plans, see the ISO/IEC 27001 page on iso.org, which lists the 2022 edition and the free 2024 climate amendment, and the NIST Cybersecurity Framework page for the voluntary framework alternative.
The most common reason a plan fails is not the wrong priorities but unrealistic dates and overloaded owners. Agree each date with the person who will do the work, not for them. Check how many open actions each owner already carries, and if one person holds a dozen, redistribute or extend dates. Keep one accountable owner per action, even where several people contribute, because shared ownership usually means nobody follows up.
Build in review points. A monthly check where each owner reports progress, and a short list of overdue items presented to management, keeps the plan visible. When a date slips, record why and agree a new one instead of quietly moving it.
Findings often repeat because teams fix the visible symptom. An access review that was missed last quarter can be completed, but if the cause is that nobody owns the schedule, it will be missed again. Ask why the gap exists, then ask why that cause exists, until you reach something you can change: an unclear role, a missing procedure, no reminder, no tool or no training. Record the root cause in field five and make sure at least one action addresses it.
If the cause is a missing document, the action is to write and approve it. If the cause is that people do not follow an existing procedure, writing another document will not help, and the action is training, monitoring or simplifying the process. If the cause is lack of resources, the action is a business case, not a policy. Matching the fix to the cause is what stops the same finding appearing in next year’s assessment.
An action is not closed because the owner says so. Define the evidence in advance, and have someone other than the owner verify it. For a policy gap the evidence is an approved, published document. For a control gap it may be operating records showing the control has run at least once. For a training gap it is attendance records and a short test. Attach the evidence, or a link to it, in the plan itself. Auditors will follow the same trail, and an owner who has to produce evidence will be more careful about what counts as done.
Consider a hypothetical software company preparing for an information security certification audit. The gap assessment finds five issues, and the team builds the plan below.
| Finding | Severity | Priority | Action and evidence |
|---|---|---|---|
| No approved risk assessment methodology | High | Quick win | Approve methodology. Evidence: signed document |
| Supplier reviews not performed | High | Major project | Assess critical suppliers. Evidence: completed assessments |
| Access rights not reviewed | Medium | Quick win | Run review and schedule quarterly. Evidence: review record |
| Incident procedure untested | Medium | Fill-in | Run tabletop exercise. Evidence: exercise report |
| Legacy laptop encryption gaps | Low | Defer with decision | Accept until refresh in Q4. Evidence: signed risk acceptance |
The table shows how one page can turn an assessment into a plan that management can approve and owners can execute.
The Gap Assessment Report and Workbook gives you a structure for full findings, a remediation plan and a live workbook, so you can track actions from finding to verified closure. If you are preparing for certification, our ISO 27001 readiness assessment guide covers what to check before the audit.
Remediation only stays funded when leadership can see it moving. Report on a fixed cadence, monthly for most teams, and keep the view short: how many findings are open, how many are overdue, which high-severity items are blocked and what decision or resource would unblock them. Show the trend across reporting periods, not just a snapshot, so a rising overdue count is visible before it becomes an audit problem. If a certification or attestation date is approaching, work backwards from it and set an internal deadline for evidence collection a few weeks earlier, so the last stretch is spent on review rather than scrambling for screenshots and signed approvals.
The gap analysis identifies where you fall short of a requirement. The remediation plan sets out the actions, owners, dates and evidence needed to close those gaps.
Cover the period until the next milestone, such as a certification audit or regulatory deadline, and review it monthly. Many organizations plan in quarterly phases and update dates as work progresses.
One person, often the compliance or security lead, should own the plan as a whole, while each action has its own accountable owner who reports progress.
Yes, if the risk is low and the decision is recorded with reasoning, an approver and a review date. Accepted gaps should be visible in the plan, not left silently open.
Provide the evidence defined for each action, such as approved documents, operating records or test results, and show that someone independent of the owner verified it.
September 30, 2026
