Performing gap assessment

Answer: Basically you have to ask questions based on standard's requirements, to identify if they are being meet or not.

For example, for requirements such as "The organization shall determine...", the question should be "Did the organization determine...". For requirements such as "The organization shall consider", the question should be "Did the organization consider...", and so on.

To help you perform a gap assessment, I suggest you to take a look at our Free ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/

This simple questionnaire will help you and your client to visualize which specific elements of a information security management system he has already implemented, and what he still needs to do.