Gap Analysis Flashcards

Compares current security posture (where we are) to a desired baseline (where we want to be). Identifies gaps and creates a remediation roadmap.

The target security standard used in a gap analysis. Examples: NIST SP 800-171, ISO/IEC 27001, or a custom organizational framework.

"Protecting Controlled Unclassified Information in Nonfederal Systems." US government baseline for organizations handling CUI. Revision 2 is commonly referenced.

International standard for Information Security Management Systems (ISMS). Used globally as a gap analysis baseline for any type of organization.

Assessing IT security staff: formal security experience, training received, knowledge of security policies. People gaps are as important as technology gaps.

Comparing existing IT systems and security procedures against baseline requirements. Identifies where documented processes are missing or insufficient.

The final output. Contains: current vs. desired state comparison, color-coded matrix, identified gaps, and a remediation roadmap with costs and timeline.

Color coding for gap analysis results. 🔴 Red = significant gaps, urgent. 🟡 Yellow = partial compliance. 🟢 Green = close to baseline. Start remediation with Red.

Formal process for approving and implementing changes. Required during gap remediation to prevent disruptions when applying security improvements to production systems.

The plan for closing identified gaps. Specifies: what actions to take, estimated costs, required equipment, timeline, and change control requirements.

Controlled Unclassified Information. Government-related information requiring protection but not classified. Organizations handling CUI must comply with NIST SP 800-171.

Commonly weeks, months, or even years for large organizations. Involves extensive data gathering, interviews, and documentation across all departments and locations.

Current state (what we have today) vs. Desired state (what the baseline requires). The difference = the gap that needs to be closed.

Define the baseline. You cannot measure any gap without first establishing the desired target state.

Gap analysis = compare processes/controls to a baseline standard (documentary, no active attacks). Penetration test = actively attempt to exploit vulnerabilities (technical attack simulation).

Controls for admin/elevated access. A key sub-requirement evaluated in gap analyses — who has privileged access and is it justified?