Gap Analysis
A gap analysis compares your organization's current controls and processes against the regulations and standards you are targeting, and identifies where the shortcomings are: gaps in policies, procedures, communication, and training that could result in security flaws, regulatory non-compliance, or non-adherence to best practices. It is a forward-looking exercise: you examine the current implementation, identify areas of concern, and produce a corrective action plan that is reviewed, agreed upon, and approved so remediation has clear guidance.
When to Do a Gap Analysis
A gap analysis is something to undertake regularly at an organizational level, often quarterly or annually depending on the regulatory complexity of your industry. There are also several situations that call for a one-off gap analysis:
| Trigger | Why It Matters |
|---|---|
| Regulatory changes | Regulation changes all the time: take the EU's 2022 Digital Operational Resilience Act, or the annual regulatory amendments to Health Insurance Portability and Accountability Act (HIPAA) and the Occupational Safety and Health Administration (OSHA) in the U.S. When new legislation or amendments come into force, a gap analysis identifies whether your current policies and procedures meet the new requirements. |
| Before an audit | The gap analysis is the first step of audit preparation: it tells you how much remediation work sits between you and the start of the audit period, which drives your timeline. |
| After risk assessments | A risk assessment identifies potential threats and vulnerabilities but doesn't necessarily offer specific guidance on addressing them. A post-assessment gap analysis outlines the differences between your current practices and the controls needed to mitigate identified risks, letting you prioritize interventions and target resources towards the most significant weaknesses. |
| During internal audits | A gap analysis narrows the audit's focus to high-risk areas and can uncover hidden vulnerabilities, helping you focus strategically on the areas that matter most. |
| When you start a new role | Moving to a different organization, or a different line of business, is the time to set a baseline and identify potential gaps and risks. It also helps you align compliance against wider business goals and understand the organization's compliance status quo. |
How to Do a Gap Analysis
The key steps are as follows.
- Identify the scope of your gap analysis
- Which regulations or standards are you targeting? This could be anything from industry-specific frameworks like HIPAA and OSHA to broader guidelines like ISO 26000. For a System and Organization Controls 2 (SOC 2) gap analysis, scope to the Trust Services Criteria relevant to the audit, as defined during audit scoping.
- What areas of your organization will be assessed? Focus on departments, processes, or systems relevant to the chosen regulations.
- Compare existing practices against the requirements
- Identify all controls and processes relevant to the organization for the chosen scope, then perform a line-by-line review against the requirements. The inconsistencies you find are your compliance gaps.
- Include all relevant parties in this review, using inquiry and walkthroughs to get a precise understanding of how each control actually operates. Involving the people who run the processes gets you accurate answers and establishes accountability for fixing what you find.
- Prioritize the identified gaps based on their potential impact and risk severity. Consider factors like financial penalties, reputational damage, and operational disruptions.
- Build a remediation plan
- For each gap, create a specific action plan: what needs to be implemented or improved to close it?
- Set clear timelines, assign responsibilities, and allocate resources for each action item. Timelines keep remediation on track and give stakeholders visibility into the forward-looking plan.
- Prioritize critical actions based on the severity of the risks.
- Track progress
- Conduct regular reviews to assess the effectiveness of your implemented controls and adherence to the requirements.
- Be prepared to adapt the action plan based on ongoing monitoring and regulatory changes.
From Gaps to Controls
After the gap analysis, the remediation work is largely control work: assessing whether new controls need to be designed for the organization to meet its compliance requirements. Controls come in three implementation forms:
| Type | Definition | Examples |
|---|---|---|
| Technical control | A control implemented by a technical system or device | Anti-malware, Security Information and Event Management (SIEM) system |
| Procedural control | A process in which employees or software perform an action to achieve the desired result | User access review, annual policy updates, endpoint compliance reviews |
| Administrative control | A guideline a business publishes in order to meet compliance objectives or the law | New company policy, code of conduct |
Every company implements controls differently depending on size and technology: one company may cover a requirement with a manual process while another automates it end to end. The objectives are the same either way. (These implementation forms are distinct from the preventative, detective, and corrective functions a control serves; see Controls for that model.)
Two recommendations for the control design conversation:
- Where only one control addresses a given criterion, we recommend designing a second, backup control. A single point of failure on a common criterion is how audits fail; a backup control keeps one broken process from failing the criterion outright.
- Have the budget conversation early. Closing gaps can cost money and resources, and the organization's management team needs to be committed to funding remediation before the audit clock starts.
The Benefits
The clearest benefit is that a gap analysis helps your organization mitigate risk and stay compliant. Beyond that:
- Prioritized compliance efforts. Revealing the severity and impact of each gap lets you focus resources on the most pressing needs first.
- Proactive risk mitigation. Gaps hidden in your processes surface before they become financial, legal, operational, or reputational damage.
- Cost savings. Strategic allocation of personnel and technology investment, and avoiding the penalties and scrutiny that come with non-compliance.
- More efficient processes. Identifying and fixing weak spots refines policies, updates procedures, and strengthens internal controls along the way.