.png){kind=small}
ISO 27001 & SOC 2 Readiness
Close the gaps and prepare for certification or audit.
Information Security Gap & Risk Assessment
A clear view of your security posture, and where to invest next.
ThreatGaurd measures your security programme against ISO 27001, NIST CSF and other recognised frameworks, identifies your most significant risks, and gives leadership a prioritised roadmap with clear owners and timelines.
Why it matters
You cannot manage risks you have not measured.
Boards, regulators, customers and insurers all expect a clear answer to a simple question: how well protected is the organisation? Without an independent assessment, that answer is often based on assumptions, tool reports or the last audit.
An information security gap and risk assessment gives you an evidence-based view of your controls and risks today, and a realistic plan to close the gaps that matter most to the business.
-
Investment without a clear plan
Security budgets go to tools and projects without a clear link to the risks that matter most.
-
Board questions without clear answers
Leaders are asked about cyber risk, but lack a simple, defensible view to report.
-
Frameworks that feel out of reach
ISO 27001, SOC 2 and new regulations set clear expectations, but the distance from today to compliance is unclear.
Business outcomes
What the assessment gives your leadership team
-
A clear starting point
An independent view of your current maturity across every security area.
-
Risks ranked by business impact
Know which risks matter most, based on likelihood and impact to the business.
-
A roadmap leaders can approve
Prioritised actions with owners, effort and timelines, ready for budgeting.
-
A path to certification
A clear route to ISO 27001, SOC 2 and the other frameworks you need.
Maturity profile
See your maturity across every function, at a glance.
Your report shows current and target maturity for each NIST CSF 2.0 function on a 1 to 5 scale, so leaders can see where investment will make the biggest difference.
- Current maturity
- Target maturity
- Govern 1.8 current, target 3.5
- Identify 2.2 current, target 3.5
- Protect 2.6 current, target 4.0
- Detect 1.5 current, target 3.5
- Respond 1.9 current, target 3.5
- Recover 1.4 current, target 3.0
What we assess
Every area of your security programme: people, process and technology.
We assess each domain against the frameworks that matter to you, using documents, interviews and technical sampling.
-
Governance and policy
Leadership, ownership and the policies that set direction.
- Security strategy, roles and accountability
- Policies, standards and how they are adopted
- Board reporting and security metrics
-
Risk management
How risks are identified, assessed, owned and treated.
- Risk register, appetite and ownership
- Asset inventory and data classification
- Risk treatment and exception handling
-
People and third parties
The human and supplier side of security.
- Security awareness and training
- Joiner, mover and leaver processes
- Supplier and third-party risk management
-
Technology controls
The technical safeguards that protect systems and data.
- Identity, access and multi-factor authentication
- Vulnerability management and secure configuration
- Network, endpoint and cloud security
-
Data protection and privacy
How sensitive and personal data is collected, stored and shared.
- Data lifecycle, retention and deletion
- Encryption and data loss prevention
- Privacy obligations such as GDPR and the DPDP Act
-
Detection, response and resilience
How well you would spot, handle and recover from an incident.
- Logging, monitoring and alerting
- Incident response plans and exercises
- Backup, recovery and business continuity
Methodology
Recognised frameworks, applied to your business.
We use the frameworks your customers, auditors and regulators recognise, and agree the right approach with you during scoping.
-
Gap assessment
Your controls measured against one framework, such as ISO 27001 or NIST CSF, with a clear list of gaps.
Best for
Preparing for certification or a specific requirement.
-
Most common
Gap and risk assessment
Framework gaps combined with a business risk assessment, so actions are prioritised by real risk.
Best for
Most organisations. One view of compliance and risk.
-
Risk assessment
An asset- and threat-based risk assessment, with a risk register and treatment plan.
Best for
Organisations building or refreshing risk management.
Standards we follow
- ISO/IEC 27001:2022
- ISO/IEC 27005
- NIST CSF 2.0
- NIST SP 800-30
- CIS Controls v8
- SOC 2 Trust Services Criteria
How it works
From kick-off to a board-ready roadmap, in five steps.
-
01
Scope and frameworks
We agree the business units, systems and frameworks in scope, and the people we need to speak to. An NDA is signed before work begins.
-
02
Gather evidence
We review policies and records, interview key people and sample technical controls to confirm what happens in practice.
-
03
Assess maturity and risk
We rate each control area, identify gaps and assess risks by likelihood and business impact.
-
04
Build the roadmap
We prioritise actions into a realistic roadmap with owners, effort and timelines.
-
05
Present to leadership
We walk your leadership team, and board if needed, through the findings and the plan.
Deliverables
Board-ready reporting, with the detail your teams need to act.
- Executive summary A board-ready view of maturity, top risks and recommended investment.
- Gap assessment report Every control area rated against the chosen framework, with evidence and clear gaps.
- Risk register Prioritised risks with likelihood, impact, owner and recommended treatment.
- Security roadmap Actions grouped into quick wins, 6-month and 12-month priorities, with effort and owners.
- Leadership briefing A clear presentation of the findings and roadmap for executives and the board.
| 5 | none | none | 1 | 1 | none |
|---|---|---|---|---|---|
| 4 | none | 1 | 2 | 1 | 1 |
| 3 | 1 | 2 | 3 | 1 | none |
| 2 | 1 | 2 | 1 | none | none |
| 1 | 2 | 1 | none | none | none |
| 1 | 2 | 3 | 4 | 5 |
Risks above appetite
7of 21 assessed
Top risk
No tested incident response plan for a ransomware attack
Related services
Turn the roadmap into results.
-
-
Regulatory & Privacy Compliance
Meet GDPR, DPDP Act and sector privacy requirements.
-
Virtual CISO (vCISO)
Ongoing security leadership to deliver the roadmap.
-
Vulnerability Assessment & Penetration Testing
Test your technical controls the way an attacker would.
FAQ
Questions leaders ask about gap and risk assessments
Can’t find your answer? Our team is happy to help.
What is the difference between a gap assessment and a risk assessment?
A gap assessment compares your controls with a framework, such as ISO 27001, and shows what is missing. A risk assessment looks at your assets and threats to decide which risks matter most to the business. We usually combine both, so gaps are prioritised by real risk.
Which frameworks can you assess against?
ISO/IEC 27001:2022, the NIST Cybersecurity Framework 2.0, CIS Controls, SOC 2 Trust Services Criteria, PCI DSS, and privacy requirements such as GDPR and India’s DPDP Act. One assessment can also be mapped to several frameworks at once.
Is this an audit or a certification?
No. It is an independent advisory assessment that shows where you stand and what to do next. Certifications and audit opinions are issued by accredited certification bodies and auditors, and this assessment is often the first step towards them.
Who do you need to speak to?
Usually leadership, IT and security, HR, legal or compliance, and the owners of key systems. Interviews are short and scheduled around your teams.
Do you check technical controls as well?
Yes, by sampling. We check configurations and records to confirm that key controls work in practice, not just on paper. For deeper technical testing, the assessment can be combined with VAPT or a cloud security assessment.
When should we carry out this assessment?
Common triggers include preparing for ISO 27001 or SOC 2, a new security leader, a board or investor request, customer due diligence, regulatory change, or a recent security incident. Many organisations repeat it every year to track progress.
How long does a gap and risk assessment take?
Most assessments take 2 to 4 weeks, depending on the size of the organisation, the number of frameworks and the locations in scope.
How is the cost calculated?
Cost depends on the size and complexity of the organisation, the frameworks in scope and the approach you choose. After the scoping call you receive a fixed-scope proposal, so the cost is agreed before work starts.
Get started
Get a clear view of your security posture, and a plan to improve it.
Tell us about your organisation and the frameworks that matter to you. We will come back with a clear scope and proposal, with no obligation.
What happens next
- A short scoping callWe learn your goals, environment and timelines.
- A fixed-scope proposalClear scope, approach, timeline and cost, in writing.
- Testing on your scheduleTesting starts on the agreed date, with regular updates.