Gap analysis

What Is Gap Analysis?

Gap analysis is a process used to identify the differences between an organization's current security state and its desired future state. It is used to compare the current security posture against a target framework, standard, or best practice to identify areas that require improvement.

Description

In cybersecurity, gap analysis is commonly used to assess how well an organization's controls align with frameworks such as NIST CSF, ISO 27001, CIS Controls, or CMMC. The output is typically a prioritized list of gaps and recommendations that forms the foundation of a security roadmap.

Usage and Examples

A gap analysis might reveal that an organization has strong perimeter defenses but lacks visibility into insider threats, or that its incident response plan hasn't been tested in two years. These findings then drive remediation priorities and budget decisions.

Evolve Security's Advisory service includes gap analysis against leading frameworks including NIST, CIS Controls, and ISO 27001 to help organizations prioritize their security investments.