Is There a Gap? — TechKnowSurge

About this interactive

A gap analysis measures the current state against the desired state: this is where we are, this is where we need to be, and what is the gap? The lesson pictures it as a ruler, with the standard marked and the company's level below it. It is usually done before a compliance audit such as SOC 2 Type 2, because failing an expensive audit costs more than finding the problems first. The lesson's gap analysis looked at three things: policies that needed strengthening, processes and procedures, and proof that things were being done. To read a line: what does the standard ask for, and does today's state reach it? Doing more than asked, such as monthly reviews against a quarterly standard, meets it. Doing the work without the record the standard asks for leaves a gap, because the auditor will ask for the proof. Security+ lists gap analysis among fundamental security concepts.

What you'll learn

Do a gap analysis line by line: compare where the company is today with the standard it has to meet, and say whether there is a gap to close
Recognize that doing more than the standard asks is not a gap, and that work done without the proof the standard asks for is

Aligned to

CompTIA Security+

1.2 Summarize fundamental security concepts.

NIST CSF

ID.IM-01 Improvements are identified from evaluations.

Key terms

Gap Analysis: A process of comparing an organization's current security or compliance posture against required standards to identify deficiencies that must be remediated.
SOC 2 Type 2: An attestation that evaluates not only whether controls are in place but also whether an organization is consistently following through with those controls over a defined period.
Audit: A formal and systematic examination of an organization's systems, policies, and procedures to verify that security controls are in place, functioning as intended, and meeting applicable compliance requirements.

Topics

Gap Analysis Compliance Frameworks Audit Preparation Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →