ISO 27001 Assessment — Pre-Audit ISMS Gap Review

IT Partner’s ISO 27001 pre-audit assessment service helps organizations with an existing Information Security Management System prepare for an external ISO 27001 audit. IT Partner reviews the ISMS against ISO 27001 standards, validates established controls and processes, identifies gaps, and provides a detailed report with actionable improvement recommendations.

This service is designed for organizations that already have an Information Security Management System in place and want to prepare before an external ISO 27001 audit. It is not described as an ISMS implementation service, because the stated prerequisite is an existing ISMS that can be reviewed and audited.

The service includes an initial discovery meeting, a thorough review of the organization’s ISMS, validation of established controls and processes, identification of gaps against ISO 27001 standards, and a detailed report with actionable recommendations. It also includes a final meeting to discuss the findings, explain the report, and provide guidance on recommended next steps.

You will receive a detailed report documenting findings, identified gaps, and actionable recommendations for improvement. The engagement also includes discovery and final review meetings, because IT Partner needs to understand your ISMS setup at the start and explain the assessment results at the end.

No, this service is a preparation assessment before an external ISO 27001 audit, not the external certification audit itself. IT Partner assesses your ISMS, identifies gaps, and provides recommendations so your organization can take corrective action before the formal audit.

No pass guarantee is stated for this service. The intended outcome is that your ISMS is assessed, gaps are identified, recommendations are provided, and your organization is better prepared to undertake the external ISO 27001 audit with confidence.

The service duration is 10 days. The core assessment runs an initial meeting on Day 1, the ISMS review on Days 2–5, reporting on Days 6–7, and a final meeting on Day 8, with the remaining time allowing for scheduling and client availability.

During the initial discovery meeting, IT Partner scopes the project and learns about your organization’s ISMS setup and audit expectations. This step is important because the assessment needs to be aligned to your existing ISMS and the external audit you are preparing for.

IT Partner conducts an in-depth review of the ISMS and related documentation to validate the effectiveness of established controls and processes. The review is performed against ISO 27001 standards to identify gaps, weaknesses, or areas of non-compliance before the external audit.

The implementation plan starts with an initial meeting on Day 1, followed by the ISMS and documentation assessment on Days 2–5. IT Partner then documents findings and recommendations on Days 6–7 and holds a final meeting on Day 8 to discuss the report and next steps.

Your organization must have an existing ISMS that can be reviewed and audited. You also need to make relevant team members available for discussions and provide the necessary permissions and access for IT Partner to conduct the review.

IT Partner needs access to the ISMS, related documentation, and relevant personnel involved in the management and operation of the ISMS. The service depends on this access because IT Partner must validate controls, review processes, and identify gaps against ISO 27001 standards.

IT Partner is responsible for conducting the discovery meeting, reviewing the ISMS, validating controls and processes, identifying gaps against ISO 27001 standards, and documenting findings in a detailed report. IT Partner also conducts the final meeting to explain findings and provide guidance on implementing recommendations.

The client is responsible for providing access to the ISMS, related documentation, and personnel needed for the assessment. The client must also review IT Partner’s findings, implement recommended actions to close identified gaps, and organize the external audit based on the assessment report.

The stated scope includes identifying gaps and providing actionable recommendations, but it does not state that IT Partner implements remediation actions. The client is responsible for implementing recommended actions, so any hands-on remediation support should be confirmed separately with IT Partner.

The service does not include the external ISO 27001 certification audit itself, certification decisions, or a guarantee of passing. It also excludes ISMS design or build where none exists, hands-on remediation of identified gaps (such as writing policies or implementing technical controls), legal or formal risk-acceptance advice, penetration testing and security monitoring, audits of suppliers or entities outside the agreed scope, and translation or evidence-pack creation beyond the assessment report. If you need any of these, IT Partner can scope them separately.

The service description does not indicate planned downtime, because the engagement is focused on reviewing the existing ISMS, documentation, controls, processes, and audit readiness. Some business impact should be expected in the form of meetings, document access, and staff participation during discussions.

The ISO 27001 pre-audit assessment is priced at $4,000 per project. Project work is quoted fixed-price in writing before work begins, and you pay after you approve delivery. If your organization has unusual scope, additional locations, or needs beyond the stated assessment deliverables, confirm with IT Partner whether any changes affect pricing before starting.

After completion, your organization should review the detailed report, prioritize the identified gaps, and implement the recommended actions to improve the ISMS. The client is also responsible for organizing the external audit based on the assessment report, because this service prepares you for the audit but does not replace it.