Quick answer: A cyber security gap analysis compares the security controls you have today with the controls a chosen framework or regulation requires, such as the NIST Cybersecurity Framework, ISO 27001 or the CIS Controls. The result is a prioritized list of gaps and a roadmap for closing them, which is why most organizations run one before an audit or certification.
A gap analysis answers two questions: where are we now, and where do we need to be? It turns a vague sense that “security could be better” into specific, costed work. This guide walks through the process, the outputs you should expect and the mistakes that make gap analyses less useful.
Gap analysis vs related assessments
| Assessment | Main question | Typical output |
|---|---|---|
| Gap analysis | Which required controls are missing or weak? | Gap register and remediation roadmap |
| Risk assessment | Which threats could cause the most harm? | Risk register with likelihood and impact |
| Audit | Do controls meet the standard, with evidence? | Formal findings or certification decision |
| Penetration test | Can an attacker actually break in? | Exploitable vulnerabilities and fixes |
These assessments complement each other. A gap analysis is broad and framework-driven, while a risk assessment decides which gaps matter most. Running both gives you a roadmap that is complete and prioritized.
Step 1: Choose the framework
Pick the standard your customers, regulators or board care about. The NIST Cybersecurity Framework suits most organizations as a general baseline, ISO 27001 suits those seeking certification, and sector rules such as PCI DSS or HIPAA apply where relevant. Our comparison of NIST CSF vs ISO 27001 can help.
Step 2: Assess the current state
Collect evidence for each control: policies, configurations, logs and interviews with the people who run them. Rate each control on a simple scale such as not in place, partially in place or fully in place. Avoid relying on policy documents alone; check that the control works in practice.
Step 3: Define the target state
Not every control needs the highest maturity. Set a target for each area based on your risk, contracts and regulatory obligations. The NIST CSF’s profiles and tiers are designed for exactly this.
Step 4: Record and prioritize the gaps
List every gap with its risk, the effort to close it and a proposed owner. Use your risk assessment to rank them so the most dangerous gaps are fixed first.
Step 5: Build the remediation roadmap
Group the fixes into phases with dates, budgets and owners. Quick wins such as enabling multifactor authentication often come first. Our guide on how to fix a risk or control gap covers the remediation side.
Common mistakes to avoid
- Treating the analysis as a one-off document rather than a living roadmap.
- Accepting “we have a policy” as proof that a control works.
- Scoping too narrowly and missing cloud services or third parties.
- Producing a long list of gaps with no priorities or owners.
Gap analysis is a core part of governance, risk and compliance and a natural first step before a cyber security audit. More resources are in our compliance and frameworks guides.
Frequently asked questions
How long does a cyber security gap analysis take?
A focused assessment of a small or mid-sized organization often takes two to six weeks. Larger, multi-site organizations can take several months.
Who should perform a gap analysis?
Internal teams can do it if they have framework expertise and independence. Many organizations use an external consultant for objectivity, especially before certification.
How often should a gap analysis be repeated?
Repeat it annually, and whenever there is a major change such as a merger, a cloud migration or a new regulatory requirement.
What is the output of a gap analysis?
A gap register listing each missing or weak control, its risk rating and owner, plus a remediation roadmap with timelines.
Conclusion
A good gap analysis turns a framework into a practical plan. Choose the right standard, test controls rather than documents, rank gaps by risk and assign owners. Repeat it each year, and your security program will improve in measurable steps.
