“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”Sun Tzu, traducere Lionel Giles · The Art of War · 1910 · The Art of War, traducerea Lionel Giles (1910), cap. III «Attack by Stratagem», §18
A gap analysis without owners and deadlines is a list of regrets.
The standard explicitly requires documented information in fourteen places: the scope (4.3), the policy (5.2), the risk assessment process (6.1.2), the risk treatment process and the Statement of Applicability (6.1.3), the objectives (6.2), evidence of competence (7.2), evidence that processes were carried out as planned (8.1), the results of risk assessments (8.2), the results of treatment (8.3), monitoring and measurement results (9.1), the internal audit programme and its results (9.2), the results of management reviews (9.3) and, at 10.2, the nature of nonconformities, the actions taken and their results. On top of those come the documents required by the controls kept in the Statement: topic-specific policies, the inventory of information and other associated assets, acceptable use rules and the rest. A good gap analysis has one line per requirement and three columns: what the standard asks, what evidence exists today and where, then the verdict — conforming, partial or absent, with an owner and a deadline. Percentages without owners close nothing.
Why it matters Stage 1 is most often failed not for lack of controls but for lack of the documented evidence the standard names outright.