Risk & governance · Fictional case study
ISO 27001 ISMS Gap Assessment
A simulated ISO 27001 gap assessment and provisional control review.
A simulated ISO/IEC 27001:2022 information security management assessment with risk treatment, provisional Annex A applicability and internal-audit rehearsal.
- My contribution
- Modeled an ISMS gap and control applicability review
- Evidence / output
- 93 Annex A control identifiers and a synthetic audit rehearsal
- Scope
- Fictional organization
Repository updated · Snapshot checked 6 Nov 2026 (UTC)
93Annex A IDs reviewed
10Modeled risks
09Simulated audit-style findings
01 / CONTEXT
Project context
An information security management system depends on scope, accountable decisions, appropriate controls and evidence of operation. This case study evaluates those building blocks without representing unverified assumptions as compliance.
02 / EXECUTION
What I did
- Created a fictional ISMS scope, asset inventory, ten modeled security risks and treatment recommendations.
- Recorded provisional necessity decisions across 93 Annex A identifiers, while keeping approvals and unverified evidence visible.
- Designed synthetic audit samples, corrective-action follow-up and management-review proposals.
- Produced a reconciled executive dashboard and automated source-data consistency checks.
03 / VERIFICATION
Evidence and outcomes
- Risk, SoA and follow-up registers are traceable to their source records.
- Controls with unknown evidence remain unverified rather than marked compliant.
- The audit and management-review materials are explicitly unsigned role-play outputs.
Full documentation and source files are in the public GitHub repository.
04 / LIMITATIONS
Limitations
Scope
Fictional ISMS exercise. No real organizational assessment, approved SoA, internal audit certification or ISO conformity claim.