Risk or Control Gap in Cyber Security