What is a gap assessment?

A cybersecurity gap assessment compares an organisation’s current security position with a defined target, and records the differences as a prioritised list of actions. The target can be a framework such as ISO/IEC 27001 or the NIST Cybersecurity Framework, a regulation, a customer requirement, or the level the client’s leadership has chosen.

The word “gap” does not mean failure. It simply describes the distance between what is in place and what is needed, and a good assessment makes that distance specific enough to act on.

What NIST says about gap analysis

NIST’s Cybersecurity Framework (CSF) 2.0, published on 26 February 2024, describes the idea clearly. It says an organisation can use the framework’s Core, Profiles and Tiers to “understand, assess, prioritize, and communicate cybersecurity risks”, and describes understanding and assessing as describing the current or target cybersecurity posture, determining gaps, and assessing progress toward addressing them.

The CSF uses two Organizational Profiles for this:

• A Current Profile specifies the outcomes the organisation is currently achieving, or attempting to achieve, and how far each is being achieved.
• A Target Profile specifies the outcomes the organisation has selected and prioritised for its risk management objectives, taking account of changes such as new requirements, new technology and threat trends.

The CSF then sets out five steps: scope the profile, gather information, create the profile, analyse the gaps and create an action plan, and implement the plan. For the gap step, it says to conduct a gap analysis to identify the differences between the Current and Target Profiles and develop a prioritised action plan, with a risk register, risk detail report or Plan of Action and Milestones given as examples. It adds that the steps can be repeated as often as needed.

Other bodies use the same pattern. The UK National Cyber Security Centre’s Cyber Assessment Framework is described as a tool to help organisations assess and improve their cyber security and resilience, measured against a CAF Profile that acts as a target level. CISA’s Cyber Security Evaluation Tool (CSET) is described by CISA as a systematic, disciplined and repeatable approach for evaluating an organisation’s security posture.

Why it matters

A gap assessment turns an open-ended question (“are we secure?”) into a bounded one (“how far are we from this target, and what comes first?”). That helps both sides of an MSP engagement. The client gets a defensible starting point and a plan, and the provider gets a baseline against which later progress can be shown.

It also feeds the rest of the programme. Findings become entries in the risk register, policy work becomes a task list, and the results can be reported to the board in one page.

How an MSP or vCISO delivers it

A repeatable gap assessment usually follows these steps.

1. Agree the target and the scope. Choose one primary framework, state its version, and say which systems, sites and services are in scope. A scope written down prevents later arguments.
2. Gather information. Review existing policies, previous audit reports, asset lists, supplier lists and any prior risk work, then interview the people who run the controls.
3. Rate each requirement. Use a simple, consistent scale such as implemented, partly implemented, not implemented and not applicable, and record the evidence for each rating.
4. Prioritise by risk. Not every gap matters equally. Rank by the risk it creates and the effort needed to close it, and note quick wins separately.
5. Write the action plan. Give each action an owner, a date and a way to confirm it is done.
6. Report in plain language. Lead with decisions needed from the client, then the detail.
7. Repeat. Re-run the assessment on a schedule and compare it with the last one.

For a worked example of a baseline assessment built on a widely used control set, see our guide to the client security baseline using CIS Controls. For how this fits into the opening weeks of an engagement, read the first 90 days playbook, and for the NIST approach in more detail, see the NIST CSF compliance guide.

Common mistakes

• Assessing against no target. Without an agreed framework or profile, the result is an opinion, not a measurement.
• Rating by conversation alone. Check that the control exists and works, by looking at evidence, not only at what people recall.
• Producing a very long list. Several hundred unranked findings make the client stop reading. Group them and prioritise.
• Mixing up a gap assessment and an audit. A gap assessment is a readiness exercise. It does not give the independent opinion an auditor provides.
• Never repeating it. A single snapshot goes out of date. The CSF itself says the steps can be repeated as often as needed.
• Ignoring ownership. An action with no named owner rarely closes.

Where GetCybr fits

If you run gap assessments across several clients, GetCybr is a platform for recording the assessment against a framework, tracking actions to closure and reporting progress in one place. It does not replace the judgement needed to rate a control or the independence of an auditor. You can see how assessments sit alongside the framework library on the frameworks page.

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. The CSF page links to the full document, which is the source for the profile and gap analysis steps (https://doi.org/10.6028/NIST.CSWP.29).
• NIST Computer Security Resource Center, SP 800-30 Rev. 1, Guide for Conducting Risk Assessments. Source for risk assessment guidance that informs prioritisation.
• UK National Cyber Security Centre, Cyber Assessment Framework. Source for the description of the CAF and its target-level profile.
• CISA, Cyber Security Evaluation Tool (CSET). Source for the description of CSET as a systematic, repeatable approach.