When to Conduct a Gap Analysis?
A gap analysis is useful when you need to understand your current cyber posture and what needs to be improved.
You may be working towards a certification, reviewing your security following growth or organisational change, planning future investment and need to understand where the priorities are, or are just looking for an independent review of your security controls.
How We Approach It
Defining Scope and Framework
We start by understanding what you’re trying to achieve and which framework or requirements we’re assessing against. We agree the scope with you before the work begins.
Current State Review
We compare what we find against the relevant indicators of best practice, considering both what is documented and what happens in practice.
Gap Identification
We’ll set out where indicators of best practice are being met, where they’re only partly met, and where work is still needed.
Prioritisation
Not every gap carries the same weight. We’ll help you understand which areas need attention first, and why.
Action Plan
You’ll receive a report covering the work needed to address the findings.
Frameworks We Support
If you’re working towards a specific framework or have requirements from a third party, get in touch. We can discuss what you need and whether a gap analysis is the right option.
What You Receive
Gap Analysis Report
A clear assessment of your current position against security best practice.
Evidence
An assessment of where your existing evidence indicates best practice and where additional work and evidence may be needed.
Practical Recommendations
We explain what needs to change and how you can approach it.
Who This Service Is For
This service is suited to organisations that need an independent view of their cyber security, and are looking to improve their posture but don’t know where to start.
What Changes After a Gap Analysis
You’ll have a clearer picture of your posture and a plan on how to improve it. Some organisations want support putting the recommendations into practice. If you need help, we can continue to support you through our Cyber Advisor or Cyber Advance services.
Perhaps more importantly, they stop worrying about what they don’t know and start making progress on what they do.
Frequently Asked Questions
It depends on scope and the complexity of your environment, but most engagements run from a few days to a few weeks. We’ll give you a clear estimate before we begin.
Not at all. We guide you through the process and explain everything in plain language. If you have technical staff who want to be involved, that’s helpful but not essential.
Yes. Many organisations move from a gap analysis into ongoing support through our vCISO service or Cyber Advance programme, where we help them work through the action plan in a structured way.
A gap analysis tells you how your controls measure up against a recognised standard. A risk assessment tells you what threats your business faces and what impact they could have. They answer different questions, and most organisations find both useful. (Compare the two services)
Start your gap analysis
Find out exactly where you stand and what to do next. No jargon, no surprises.