What is a gap analysis?
A gap analysis is an assessment that compares where an organization's security program is now with where it needs to be, and lists the differences. The target might be a standard the organization wants to be certified against, a new version of a standard it already follows, a regulation about to take effect, or a target profile in a framework such as the NIST Cybersecurity Framework. The output is not a pass or fail but a prioritized list of shortfalls that becomes a remediation plan.
How a gap analysis works
- Pick the target and its exact version, for example ISO/IEC 27001:2022 or PCI DSS v4.0.1.
- Set the scope: which business units, systems, locations and data are included.
- Assess the current state of each requirement using documents, interviews, configuration reviews and sample records.
- Rate each requirement as met, partially met or not met, and describe the gap in concrete terms.
- Prioritize by risk, effort, cost and deadline, then give each gap an owner and a target date.
- Track closure, often in the risk register or a project plan, until a formal audit confirms the result.
Example: moving to ISO/IEC 27001:2022
The 2022 edition of ISO/IEC 27001 reorganized its Annex A into 93 controls and introduced several new ones, and organizations certified to the 2013 edition had until October 31, 2025 to transition. A company in that position runs a gap analysis against the new controls:
| Control | Current state | Status | Action and owner |
|---|---|---|---|
| 5.7 Threat intelligence | Analysts read vendor advisories informally; no process to act on them | Partial | Define sources and a triage process; security operations, Q1 |
| 5.23 Information security for use of cloud services | Cloud purchases reviewed case by case; no policy | Partial | Write a cloud security policy with exit criteria; CISO, Q2 |
| 8.12 Data leakage prevention | No DLP for email or endpoints | Not met | Select and deploy DLP, email first; IT, Q3 |
| 8.9 Configuration management | Hardened baselines enforced by Group Policy and checked monthly | Met | None |
Gap analysis vs. audit, risk assessment and benchmarking
- Audit: an independent, evidence-based judgment of whether requirements are met, often with an opinion or certificate that outsiders rely on. A gap analysis usually comes first, to prepare for it.
- Risk assessment: identifies threats and vulnerabilities and rates their likelihood and impact. A gap analysis measures the distance to a set of requirements, whatever the risk.
- Benchmarking: compares the organization with peers or a published baseline. It answers "how do we compare?", while a gap analysis answers "what is missing?"
When organizations run one
The usual triggers are planning a first certification, a new version of a standard, a regulation with a compliance date, a merger that brings in an unfamiliar environment, or a new CISO who needs a baseline. Gap analyses can be done by an internal team or a consultant. Because they are for internal planning, the findings tend to be candid, but they lack the independence of an audit, so customers and regulators rarely accept one as proof of compliance.
Gap analysis on the CompTIA Security+ exam
SY0-801 lists gap analysis among the audit and assessment types under objective 5.5, alongside internal and external audits and benchmarking. Scenario wording such as "identify which requirements are not yet met," "prepare for certification" or "compare current controls with the new version of the standard" points to a gap analysis. The usual distractors are a third-party audit, which judges conformance rather than preparing for it; benchmarking, which compares against peers; and a risk assessment, which rates threats rather than measuring distance to a set of requirements.