What is a gap assessment?

How a gap assessment works

Fix the scope and the framework edition first. Then go through each requirement and record what is in place today, with the evidence that shows it. Each requirement gets a status, and each gap gets an owner, a priority and a target date.

Look for evidence of what happens. A team that says it reviews access every quarter but cannot produce the last review has a gap, even if the review sometimes takes place.

• Met. The control exists, runs and leaves evidence an auditor would accept.
• Partly met. Something is in place but is undocumented, inconsistent or missing evidence.
• Not met. Nothing addresses the requirement yet.
• Not applicable. The requirement does not apply to the scope, and the reason is recorded.

What it usually finds

Technical controls are often further along than expected, especially in companies built on cloud services. The gaps cluster in the written and recurring parts of a programme: missing policies, no formal risk assessment, vendor reviews that never happened, and access reviews with no record.

For ISO 27001, the management system clauses are a frequent gap: scope, risk method, Statement of Applicability, internal audit and management review. For CMMC Level 2, gaps against the 110 NIST SP 800-171 requirements feed straight into the System Security Plan and, where allowed, a Plan of Action and Milestones.

Who should do it

Your own team can run a gap assessment if someone knows the framework well. An outside consultant brings experience of what auditors accept. Either way, the people who run the systems need to take part, because they know what really happens day to day.

Independence rules limit who can help. A certification body may not act as consultant for the management system it certifies, so its pre-assessment can point out gaps but not design the fixes. If a SOC 2 audit firm offers readiness work, ask how it keeps that work separate from the audit.

Repeat the assessment when you add a framework. With mapped controls, the second assessment is mostly a check of which existing controls already meet the new requirements.

Related terms

Audit-ready

The point at which scoped controls, policies, a risk register and evidence are in place, so an auditor can be engaged and the audit can start without a scramble.

Control mapping

Linking one control to every framework requirement it satisfies, so the same control and its evidence count towards SOC 2, ISO 27001 and other frameworks at once.

Plan of Action and Milestones (POA&M)

The CMMC and NIST document listing unmet requirements with the planned fix, owner and date. Only a limited set of requirements may sit on a POA&M at a CMMC assessment.

Risk register

The list of identified risks with an owner, likelihood, impact, treatment and review date, linked to the controls that treat each one. Usually the first document an auditor asks to see.

Internal audit

A review of the management system by someone independent of the area being audited. ISO 27001 and ISO 42001 require one before certification and at planned intervals after it.