The steps
- Choose the framework and its edition, and define the scope.
- Break it down into requirements you can check one by one.
- Gather what exists: documents, records, configurations.
- Interview those who do the work.
- Rate each requirement with a simple scale.
- Prioritise the gaps by risk and by legal or contractual deadlines.
- Write the action plan with owners and dates.
A rating scale
- Met: in place, with evidence.
- Partly met: exists but incomplete, undocumented or unproven.
- Not met: absent.
- Not applicable: with the reason.
What the report contains
- The scope, the framework and the date.
- A summary by domain.
- Each gap: the requirement, what was seen, and what is missing.
- The priorities and the action plan.
Gap assessment or audit?
A gap assessment prepares you and is meant to find everything. An audit gives an independent conclusion against criteria. A gap assessment gives you no certificate, but it tells you when you are ready for one.
Questions
- Who should run a gap assessment?
- Someone who knows the framework and can see the evidence. Internal teams can do it; an outside view helps where the team built the controls itself.
- How long is a gap assessment valid?
- It is a picture at one date. Repeat it after significant changes or when the framework changes.