Gap assessment compares your current security state with a required or desired state. Gap analysis then explains why each shortfall exists and how to close it. Done early, both catch weaknesses before they become audit findings or incidents.
The stakes are real. IBM's 2025 report puts the average US data breach at $10.22 million, up 9%. That is breach-cost context, not a measured return on assessments, but it shows what unaddressed gaps can eventually cost.
Key Takeaways
- Assessment finds the differences; analysis finds causes and actions.
- Objective evidence and control testing beat self-reported maturity.
- The workflow: scope, target state, current state, gap matrix, prioritization, remediation.
- A useful output has owners, timelines, evidence requirements, and retesting dates.
What Is Gap Assessment and Analysis, and Why Does It Matter in Cybersecurity?
ASQ defines a gap comparison as comparing a current condition to the desired state. In cybersecurity, NIST CSF 2.0 frames this as comparing a Current Profile with a Target Profile, then building a prioritized action plan.
The assessment says what is missing. The analysis says why it is missing and what it will take to fix it.
Components of a useful assessment
- Current state and required or desired state
- Assessment criteria and supporting evidence
- Identified gaps with a risk or priority rating
- Recommended next steps
Where assessments are applied
- NIST CSF and ISO 27001 alignment
- HIPAA and PCI DSS readiness
- SOC 2 preparation
- Cyber insurance applications, where carriers such as Corvus by Travelers ask about MFA scope, EDR, and offline backups (carrier-specific, not universal)
- Customer security reviews and third-party risk
- Cloud security, such as CISA's SCuBA baselines for Microsoft 365 and Google Workspace
- Incident-response readiness
Business outcomes
NIST says CSF profiles help prioritize cybersecurity activities and inform spending decisions. ISACA's 2024 analysis notes that audits surface control gaps and outdated policies, with follow-up checking that fixes were implemented. The benefits are qualitative: better investment decisions, fewer compliance surprises, clearer accountability, and programs that scale.
How it differs from SWOT and risk assessment
- SWOT looks at strengths, weaknesses, opportunities, and threats. It doesn't compare controls to a defined target.
- Risk assessment evaluates the likelihood and impact of events. NIST SP 800-30 treats risk as a function of threat likelihood and adverse impact.
The two connect. CSF names a risk register or plan of action and milestones (POA&M) as a home for prioritized gaps, and ISO 27001 clause 6.1.3 requires a risk treatment plan approved by risk owners.
How Gap Assessment and Analysis Works – Step by Step
Step 1: Define the objective and scope
Name the business reason: a HIPAA review, a SOC 2 audit, a stalled enterprise deal. Then list the systems, locations, departments, third parties, and stakeholders in scope.
Avoid goals like "review all security." HIPAA risk analysis must cover all ePHI, and PCI scope includes the cardholder data environment and connected systems. Scope is set by the requirement, so be specific.
Step 2: Establish the required or desired state
Pick the benchmark: NIST CSF, ISO 27001, HIPAA, PCI DSS, SOC 2, a customer contract, a carrier's control list, or an internal maturity target. Then translate it into specific, testable expectations.
"Strong access control" isn't testable. "MFA on all remote and administrative access" is.
Keep legal obligations separate from voluntary benchmarks. HIPAA's risk analysis is mandatory; HHS healthcare cybersecurity performance goals are voluntary.
Step 3: Gather and validate current-state evidence
Collect:
- Policies and procedures
- Asset and access records
- Vulnerability and penetration-test results
- Configuration data and monitoring evidence
- Training records and incident reports
- Stakeholder interviews
NIST SP 800-53A uses three methods: examine, interview, and test. A written policy proves intent. Testing proves operation. SOC 2 makes the same split: Type 1 covers design at a point in time, Type 2 covers operating effectiveness over a period.
Step 4: Compare current state with target state
Build a gap matrix with these columns:
- Requirement
- Current condition
- Evidence
- Shortfall
- Affected asset or process
- Control status
Classify each control as:
- Missing
- Partially implemented
- Ineffective
- Lacking sufficient evidence
That last category matters. NIST's "other than satisfied" finding covers insufficient evidence, not only failures.
Step 5: Analyze root causes and prioritize
Ask why each gap exists. Common causes:
- Unclear ownership
- Too little staff
- Outdated technology
- Weak processes or poor documentation
- Vendor dependencies
- No testing
Then rank by business impact, exploitability, compliance significance, urgency, and effort. Don't treat scores as interchangeable.
CVSS measures severity, while EPSS estimates the probability of exploitation in the next 30 days. CISA's Known Exploited Vulnerabilities catalog flags what attackers are already using.
Step 6: Create, implement, and review the remediation plan
Turn each priority gap into an action with an owner, resources, a target date, dependencies, required evidence, and a validation method. NIST's RMF describes Plans of Action and Milestones (POA&Ms) that record findings, corrective actions, milestones, and completion dates.
Schedule retesting. Reassess after audits, incidents, acquisitions, major technology changes, and new regulations.
Example Walkthrough: A Mid-Market Healthcare Organization
This scenario is illustrative. It is not a DeepSeas customer case study.
A mid-market US healthcare provider faces a compliance review and a large customer's security assessment.
Target and current state
Target: documented access controls, tested incident response, centralized logging, vendor oversight, and evidence that controls run on a recurring basis.
Current: inconsistent documentation and decentralized ownership.
What the assessment finds
| Area | Gap | Classification |
|---|---|---|
| Identity and access | Policy requires quarterly access reviews; only one was ever done | Ineffective |
| Security monitoring | Logs sit in separate tools, no central view | Partial |
| Incident response | Plan exists but was never exercised | Insufficient evidence |
| Third-party risk | No tiering of vendors that touch patient data | Missing |
| Policy governance | Several policies lack owners or review dates | Partial |
| Evidence collection | Proof scattered across inboxes | Missing |
The access-review row shows the written-versus-operating split. The control exists on paper, but testing shows it doesn't run.
OCR enforcement shows what's at stake. In 2026, OCR settled with Ambry Genetics for $700,000 over potential failures in risk analysis, terminating ePHI access, and unique user identification. This is an enforcement example, not a sector-wide prevalence figure.
Prioritization and action plan
- Immediate safeguards: enforce MFA, remove stale accounts, and name an owner for each critical gap.
- Risk register: link critical gaps to entries with treatment decisions.
- Near term: centralize logging and run a tabletop incident-response exercise.
- Longer term: build vendor tiering and a policy review calendar.
- Checkpoints: set validation dates for each action.
The review loop
Retest the fixed controls. Update the evidence repository. Compare results with the original target state. Carry unresolved items into the next budget cycle, policy updates, security operations plans, and the next assessment's scope.
How DeepSeas Can Help
Practitioner-led GRC and cybersecurity advisory
DeepSeas helps organizations define assessment scope, map current controls to applicable requirements, identify weaknesses, prioritize remediation, and turn findings into practical security and compliance actions.
That work is backed by:
- Roughly 30 years of cyber defense experience
- Practitioner-led GRC engagements with ISO Lead Auditor-certified specialists
- Experience across NIST, ISO, HIPAA, GLBA, PCI, and other regulated environments
- Platform, advisory-only, or fully managed GRC options, with automated control mapping and evidence packaging for auditors, insurers, and customers
Some gaps go beyond documentation. If the assessment exposes weak monitoring or untested defenses, DeepSeas can connect those findings to strategic advisory, offensive security, threat intelligence, managed detection and response, and the CyberFusion SOC.
It also supports existing SIEM, EDR, and CNAPP tools, so you don't have to replace what you own.
Conclusion
Gap assessment shows where you stand. Gap analysis explains the causes and consequences. Remediation planning turns those findings into measurable improvement.
The best assessments rely on evidence, rank gaps by business and security risk, and assign every action to an accountable owner. Teams repeat the process as systems, threats, and regulations change.
Frequently Asked Questions
What is a gap assessment?
It compares an organization's current capabilities with a required or desired state. It applies to cybersecurity controls, compliance, skills, processes, and technology.
What is the difference between a SWOT analysis and a gap assessment?
SWOT evaluates internal strengths and weaknesses plus external opportunities and threats. A gap assessment compares performance or controls with defined requirements and identifies actions to close shortfalls.
What is a gap assessment in software development?
It compares current development practices with a target, such as NIST's Secure Software Development Framework or OWASP SAMM. It covers secure SDLC practices, testing coverage, deployment controls, and customer requirements.
How do you perform a cybersecurity gap assessment?
Define scope, pick a framework, collect evidence, and compare current with target state. Then prioritize gaps, build a remediation plan, and validate completed actions.
What should a gap assessment report include?
Scope, benchmark, evidence reviewed, current state, gaps, priority ratings, root causes, recommended actions, owners, timelines, and a retesting plan.
