Step 3 of 6 · Plan
Gap analysis What is already there and what is missing.
Now you go through the requirements one at a time. Mandatory points come first, so the important things are not left until the end.
What it is about
The standards are long and they overlap. Working through them side by side means answering the same question three or four times. In UniqSuite, equivalent requirements are grouped into shared control points. One answer counts in every framework that asks for the same point.
How you go about it
- You see one requirement per card, in plain language and with its reference to the standard.
- You answer with one click: implemented, partly implemented or not implemented. Where needed, you attach evidence.
- If a requirement does not apply to you, you write briefly why. That reason later goes into the Statement of Applicability.
- To go deeper, switch to the detail view with maturity level and evidence.
What UniqSuite does for you
- If one answer covers several frameworks, the weakest implementation counts in case of doubt. Nobody can talk the status up.
- The implementation status per framework is calculated as you go. After every answer you see where you stand.
What you end up with
Your implementation status per framework and a list of open gaps.
Where the requirements come from
- ISO/IEC 27001, Annex A: the 93 controls, the basis of the Statement of Applicability
- BSIG section 30(2): the ten areas of risk management measures
- For the AI Act, ISO/IEC 42001 and the CRA, the same approach applies with their own catalogues.
The references show where the requirements come from. They do not replace a legal assessment.
How far along are you with this step?
The quick check shows you in two minutes. Or let us show you UniqSuite with your own questions.