What is a gap assessment?
A gap assessment compares your current controls and practices with the requirements of a framework or regulation to find what's missing. Here's how to run one.
A gap assessment, or gap analysis, compares an organization's current controls, policies, and practices with the requirements of a framework, regulation, or target state, and records where they fall short. The result is a list of gaps, each with a severity and a plan to close it. Teams often run one to prepare for a first audit or certification.
How to run one
- Pick the targetThe framework or requirements you're measuring against.
- Gather evidenceDocuments, tool data, and interviews.
- AssessMark each requirement met, partly met, or not met.
- PrioritizeRate each gap by risk.
- PlanOwners, fixes, and dates.
What to look for
A gap assessment should turn into a live list of findings with owners. Look for a tool that pre-fills from what you already have.
Questions
What is the difference between a gap assessment and an audit?
A gap assessment is an internal readiness exercise. An audit is a formal, independent evaluation.
See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.