Study Guide
Gap Analysis
Comparing where an organisation is with where it needs to be, scoring the difference, and deciding what to fix first by risk rather than by percentage alone.
Lesson 5.14 Governance, Risk & Compliance
Before you can improve something, you need to know where you are now and where you need to be. This lesson works out a disciplined way of finding the difference, how to score it, and why the results are easy to misread.
Stage: Think
Ten kilometres by summer
Think it through
You want to be able to run 10 km by the summer. Before planning any training, what two things do you need to know?
- Hint 1: What would a training plan start from?
Show what happens
Where you are now (how far you can run today) and where you need to be (10 km by the summer). The difference is what the training has to close.
Think it through
Show the answer
Answer: A. Check, using evidence.
Check, using evidence: run and time it. Organisations need the same honesty about where they are.
Stage: Explain
The idea
A sat nav needs two facts before it can help: your current position and your destination. The route is whatever lies between them. Gap analysis works the same way.
- The current state is what the organisation actually does today.
- The target state, sometimes called the desired state, is what it needs to be doing. The target comes from somewhere definite: a framework, a standard, a contract, a law or the organisation’s own policy.
- A gap is a place where the current state falls short of the target.
- Remediation is the set of improvements that close the gaps.
Put together: comparing the current state with the target state identifies the gaps, and the gaps determine the improvements. The same idea fits in two questions: “Where are we now?” and “Where should we be?”
Check your understanding
Show the answer
Answer: C. No: it is a comparison.
No. It compares the current state with a target, using documents, settings, records and conversations.
A gap analysis is a comparison, not an attack. It is usually carried out by reading documents, checking settings and records, and talking to the people who do the work. It does not try to break into anything.
Stage: Predict
Four steps
Think it through
Put these in order: plan the remediation, identify the gaps, define the target, assess the current state.
- Hint 1: What must exist before anything can be compared?
Show what happens
Define the target, assess the current state, identify the gaps, then plan the remediation. Without a target there is nothing to compare with.
An original diagram. The cycle repeats because both the organisation and the target change.
- Define the target state
Choose what to measure against: a framework, a standard, a contract or the organisation’s own policy. Without a target there is nothing to compare with.
- Assess the current state
Find out what is really in place, using evidence and not assumptions: documents, settings, records and conversations.
- Identify the gaps
List each place where the current state falls short of the target, and say what is missing.
- Plan the remediation
Decide what to fix first by risk, give each action an owner and a date, and carry it out.
↺ Return to Define the target state with what you have learned.
The work repeats. Once improvements are made the current state has changed, so the old results are out of date. Targets move as well: frameworks are revised, and the organisation takes on new systems and new obligations.
Stage: Predict
A worked example: scoring against a framework
A gap analysis can be scored against a framework such as the NIST Cybersecurity Framework. In this example, each area has an achieved-versus-total score, such as 10/16 and 4/6. The detailed assessment criteria behind each point are not specified, so this lesson does not say what an individual point stands for. It uses the scores only as given: an amount achieved out of a total.
The same figures as a table:
| Area | Achieved | Total | Score |
|---|---|---|---|
| Identify | 10 | 16 | 62.5% |
| Asset Management | 4 | 6 | 66.7% |
| Governance | 3 | 4 | 75% |
| Risk Assessment | 3 | 6 | 50% |
| Protect | 8 | 16 | 50% |
| Identity and Access Management | 5 | 8 | 62.5% |
| Data Security | 3 | 8 | 37.5% |
Think it through
Show the answer
Answer: A. Add the figures, then divide.
Add the achieved figures and the totals across the areas, then divide: the areas are different sizes.
How the scores are calculated
Each percentage is achieved ÷ total × 100. For Asset Management, 4 ÷ 6 = 0.667, which is 66.7%.
In the example, a Function’s score is the sum of its areas’ figures, not the average of their percentages. For Identify, the achieved figures are 4 + 3 + 3 = 10 and the totals are 6 + 4 + 6 = 16, and 10 ÷ 16 is 62.5%. Averaging the three percentages (66.7%, 75% and 50%) would give about 63.9%, which is wrong, because the areas are different sizes.
Check your understanding
Show the answer
Answer: A. 50%
50%: 5 + 3 = 8 achieved, out of 8 + 8 = 16.
Scores like these help to visualise where an organisation falls short: a bar that is mostly hollow stands out at once. That is their use. That arithmetic is all that the figures themselves support.
Stage: Predict
Reading the scores
Think it through
An area scores 75%. List what that number cannot tell you.
- Hint 1: Would you know which quarter is missing?
Show what happens
What is missing, how much that area matters to this organisation, how good the evidence was, and how the points were defined or weighted.
A percentage tells you how much of the target is met in one area. That is useful, and it is all it tells you. A score does not tell you:
- what is missing. The same shortfall could be minor or critical;
- how much the area matters to this particular organisation;
- how good the evidence was. “Yes, we do that” from one person is weaker than a tested result;
- how the points were defined or weighted. Unless the assessment criteria are stated, a point in one area cannot be assumed to matter as much as a point in another.
Stage: Predict
Prioritise by risk, not by percentage
In the example, Data Security has the lowest score, 37.5%, and Governance has the highest, 75%. It is tempting to conclude that Data Security must be fixed first and that Governance can wait.
Think it through
Show the answer
Answer: C. Not necessarily.
Not necessarily: priority depends on impact, criticality, likelihood and context, not on the percentage alone.
That may turn out to be right. The percentages cannot tell you. The lowest raw percentage is not automatically the highest-priority risk. Priority also depends on business impact, on how critical the affected system is, on likelihood and on context.
The example gives only scores. The detail below is invented to show the reasoning.
- Gap A is in the best-scoring area. Governance scored 3/4. Suppose a gap in that area is that nobody is named as responsible for the system that takes customer payments. If that system is attacked, nobody has the authority to act. The system is critical, the consequence is serious and the situation is plausible.
- Gap B is in the worst-scoring area. Data Security scored 3/8. Suppose a gap in that area is that old drafts of a public newsletter, kept on a shared drive, are not encrypted. The information is already public, so little harm would follow.
- Compare them by risk. Gap A affects a critical system and has a high impact. Gap B affects low-value information and has a low impact. Gap A comes first, even though its area has the best percentage.
- Do not stop there. Whatever else lies behind the Data Security score deserves the same questions. Some of it may well be urgent.
Check your understanding
Show the answer
Answer: B. Its impact is far higher.
Its impact is far higher: it affects a critical system, while Gap B concerns information that is already public.
For every gap, ask:
- Impact: what would happen to the organisation if this gap were exploited?
- Criticality: how important is the system or information it affects?
- Likelihood: how probable is it that something goes wrong here?
- Context: is another control already covering the gap? Is there a legal or contractual deadline? How long would the fix take, and what would it cost?
Assessing Risk explains how likelihood and impact are rated. Security Controls explains compensating controls, which are one reason a gap may be less urgent than it looks.
Stage: Predict
From gaps to a remediation plan
Think it through
You have a list of twelve gaps. What does each one need before anything gets fixed?
- Hint 1: Who will do it, and by when?
Show what happens
An action that will close it, an owner, a date and a way of checking it was done, or a deliberate, recorded decision to accept it.
A list of gaps is not the result. A plan is. For each gap the plan records:
- the action that will close it;
- an owner who is responsible for the action;
- a date by which it should be done;
- how completion will be checked.
Not every gap has to be closed. An organisation may decide to accept one, as long as someone with the authority to do so makes that decision deliberately and it is recorded. Treating Risk covers the options. When the actions are complete, the current state is assessed again, which is why the gap-analysis diagram is a cycle. Plan–Do–Check–Act describes the same habit of checking and improving.
Stage: Explain
Gap analysis and the NIST framework
The NIST Cybersecurity Framework is useful for gap assessments. The framework has its own names for the two things being compared: an organisation’s Current Profile describes the outcomes it achieves now, and its Target Profile describes the outcomes it wants to achieve. Comparing the two reveals the gaps. Profiles are mentioned here only because they are the framework’s words for the current and target states.
Check your understanding
Show the answer
Answer: C. Two Profiles
A Current Profile and a Target Profile: the framework’s names for the current and target states.
Gap analysis is not tied to NIST. The target can equally be the requirements of Cyber Essentials, an ISO/IEC 27001 control set, a customer’s contract or an internal policy. Security Frameworks and Standards describes those.
When you are shown a set of scores, ask two questions before discussing priorities: “what exactly is missing in each area?” and “which of those gaps touch our most important systems?”. The answers usually reorder the list.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: C. It met that target.
It means the whole of that target was met at that time. Compliance with a target is not the same as security.
Apply it
Show the answer
Answer: A. It should be 62.5%.
Add the figures, then divide: 10 of 16 is 62.5%. Averaging percentages is wrong when the areas are different sizes.
Apply it
Show the answer
Answer: C. Accept it, on record.
Accept it: someone with the authority to do so decides deliberately, and the decision is recorded.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: The current state with the target state, to find where the organisation falls short
Gap analysis compares the current state with the target, or desired, state to identify gaps and then decide on improvements or remediation. The current state is what the organisation does today, and the target is what it needs to be doing. A gap analysis is a comparison, not an attack: trying to break in is a penetration test, which answers a different question. Comparing spending with other organisations, or the cost of a control with the loss it prevents, are different exercises: neither measures the organisation against its own target.
Revision sources: Gap Analysis (Supplementary Study Guide explanation)
Show answer
Answer: Define target state → assess current state → identify gaps → plan remediation
There are four steps: define the target state, assess the current state using evidence, identify the gaps, and plan and prioritise remediation. Gaps can only be listed once both the target and the current state are known, so identifying gaps cannot come before either of them. Remediation comes last, because it depends on which gaps were found. The work then repeats, since both the organisation and the target change over time.
Revision sources: Gap Analysis (Supplementary Study Guide explanation)
Show answer
Answer: 65%
A combined score adds the achieved figures and the totals and does not average the percentages. The achieved figures are 5 + 2 + 6 = 13, the totals are 8 + 4 + 8 = 20, and 13 ÷ 20 is 65%. Averaging the three percentages, 62.5%, 50% and 75%, gives 62.5%, which is wrong, because the areas are different sizes: the smallest area would count for as much as each of the larger ones. The figures are invented for this question.
Revision sources: Gap Analysis (Supplementary Study Guide explanation)
Show answer
Answer: False
False. The lowest raw percentage is not automatically the highest-priority risk. In a scored example where Data Security has the lowest score, 37.5%, that score still shows only how much of a target is met in one area. It does not show what is missing or how much it matters. Priority also depends on business impact, on how critical the affected system is, on likelihood and on context, so a gap in a well-scoring area can be more urgent than those in a poorly scoring one.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Gap Analysis (Supplementary Study Guide explanation)
Show answer
Answer: The payments system, because it is critical and the impact of the gap is high
Priority depends on business impact, system criticality, likelihood and context, not on the percentage alone. The payments system is critical, and having nobody responsible for it means that nobody has the authority to act if it is attacked, so the impact is high. The newsletter drafts are already public, so little harm would follow if they were read. Whether a gap is technical or organisational does not decide its priority, and neither does the score of its area: the payments gap comes first because of its impact, not because its area scored 75%.
Revision sources: Gap Analysis (Supplementary Study Guide explanation)
Study and revision
Practise through the Governance & Policy revision topic. Questions cover what a gap analysis compares, the order of its steps, how a score is calculated, why the lowest score is not automatically the first priority, and what else decides priority; two flashcards recall what a gap analysis compares and what decides which gap comes first. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 1.2 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- Gap analysis compares the current state with a target state; the gaps decide the improvements.
- Four steps: define the target, assess the current state with evidence, identify the gaps, plan the remediation; then repeat.
- A group’s score is the sum of its areas’ figures, not the average of their percentages.
- A score shows how much of a target is met, not what is missing or how much it matters.
- Prioritise by risk: impact, criticality, likelihood and context; every gap needs an action, owner, date and check.
Key terms
- Gap analysis
Comparing the current state with the target state to identify the gaps, and then deciding which improvements will close them.
Common misunderstandings
A score measures how much of a target is met. Priority depends on impact, criticality, likelihood and context.
It means the whole of that target was met at that time. Compliance is not the same as security.
It is a comparison against a target, not an attempt to break in. A penetration test answers a different question.
Add the figures, then divide. Averaging percentages gives the wrong answer when the areas are different sizes.
The value is in the plan that follows: actions, owners, dates and a re-assessment.
Further reading
- NIST Cybersecurity Framework: frequently asked questions, which describe Current and Target Profiles.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 3 (see the Session 3 Learning Log): the NIST Cybersecurity Framework as useful for gap assessments, comparing “Where are we now?” with “Where should we be?”.
- Covered in Session 7 (see the Session 7 Learning Log): gap analysis, and the scored example, with the figures shown in the diagram and table.
- Accuracy qualification: the lowest raw percentage is not automatically the highest-priority risk. Priority also depends on business impact, system criticality, likelihood and context.
- Supplementary explanation: the definition of gap analysis as a comparison of the current state with the target state, the sat-nav comparison, the four steps and their diagram, how the scores are calculated, what a score does not show, the two-gaps example, the questions for each gap, the remediation plan, the note on Profiles, the practical note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The bar diagram is original and its percentages are calculated from the session’s figures.
- Not specified in the session: the assessment criteria behind each point in the example’s scores, and whether the figures described a real organisation. This lesson does not state what an individual point represents.
- Fictional detail: the two gaps in the worked example are invented.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the running opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not carried out a gap analysis for an organisation.
An alternative safeguard used when the preferred control cannot be implemented, reaching a similar security objective another way.
Meeting applicable legal, contractual and internal requirements.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A UK certification scheme covering five technical control areas and based on verified self-assessment. Cyber Essentials Plus adds technical verification.
Comparing the current state with the target state to identify the gaps, and then deciding which improvements will close them.
The direction, accountability and oversight through which an organisation sets and checks its security decisions.
The discipline of managing identities and what they can reach: accounts, roles, permissions, authentication and the access lifecycle.
How serious the consequences of an event would be for the organisation and the people affected.
The international standard specifying requirements for an ISMS within a defined scope. Organisations can be certified against it.
How probable it is that a defined event will happen over a stated period.
The principle that a person should access particular information only where their role gives a legitimate requirement for it.
A framework organising cybersecurity outcomes into Functions: six in version 2.0 (Govern, Identify, Protect, Detect, Respond and Recover), and five, without Govern, in earlier versions.
A document that sets organisational rules and expectations, defining what is and is not permitted.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A document that specifies requirements or recognised practices to be met.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.