Before pursuing ISO/IEC 27001 certification, a company wants to compare its current cloud security controls against the standard's requirements to see what is missing, and to have control owners rate how well their own controls work. Which activity fits this need?
Select an answer to reveal the explanation.
Short Explanation
A gap analysis is like holding your current kitchen up against the recipe and listing what's missing before you start cooking. Add a self-assessment where each control owner grades their own control and you've got your starting picture. The other options are real tools, they just answer different questions.
Full Explanation
A gap analysis compares the current state of controls, policies and processes against a target such as ISO/IEC 27001 requirements or a control baseline, and identifies where controls are missing, partially implemented or undocumented, producing a remediation plan before the certification audit. A risk and control self-assessment complements it by having the owners of risks and controls evaluate their own controls' design and effectiveness, which is efficient, builds ownership and highlights areas for deeper review. Together they give the company the readiness view it wants. A SOC 2 Type II examination is an independent attestation on controls against the trust services criteria over a period; it is not a readiness comparison against ISO/IEC 27001 and is far costlier for this purpose. A penetration test probes technical exploitability of specific systems; it reveals vulnerabilities but does not map the management system and controls against a standard's requirements. A business impact analysis determines the criticality of processes and recovery objectives for continuity planning, not conformity of the control environment. Exam caveat: self-assessment results are not independent, so they are an input to, not a substitute for, internal or certification audits. Operational check: confirm the gap register maps every requirement and control to a status, an owner and a target date.