Gap analysis — ISO 27001:2022

The first gap analysis of the ISMS, led by Patrick Ellison, the ISO 27001 consultant, together with Sam de Vries. They went through the clauses and the Annex A controls one by one and compared each requirement with how Tidewell IT actually works.

Most management system clauses were missing or informal. Controls for access, supplier management, and incident handling were partly in place, while monitoring and backups were already strong. The result is the starting point for the risk register, the Policies, and the plan towards certification.