A gap analysis asks: where are we, where should we be, and what is missing in between? It is used in strategy, quality management, IT projects and especially often in compliance.
Four steps
First the target state is defined, for example the requirements of the GDPR, NIS2 or ISO 27001. Then the current state is captured through documents, interviews and samples in systems. Third, deviations are described and rated by risk, urgency and effort. Finally, a prioritised action plan is derived.
Rating the gaps
Not every gap is equally important. A rating by likelihood and impact, supplemented by legal deadlines, has proven useful. A missing reporting chain for cyber incidents weighs more than outdated wording in a policy. It also helps to ask whether one measure closes several gaps at once.
Common mistakes
The current state is often derived from documents without checking whether practice matches them. Equally often the target state is not delimited: a gap analysis against a standard that does not apply creates work without benefit. That is why, in compliance, the applicability check comes before the gap analysis.
Gap analysis and requirements work
Methodologically, a gap analysis is related to requirements engineering: eliciting and refining requirements and checking them against an existing solution. Our compliance assessment combines applicability check and gap analysis across several regulations.