What Is a Cyber Security Gap Analysis?

A cybersecurity gap analysis shows you the difference between the security controls your organisation has today and the level of security it actually needs.

That sounds straightforward, but the useful part isn’t simply discovering that a policy, process or technical control is missing. It’s understanding whether the controls you already rely on are properly implemented, consistently enforced and capable of reducing the risks they’re supposed to address.

That’s an important distinction. The UK Government’s latest Cyber Security Breaches Survey found that just 24% of businesses reported having controls across all five areas associated with Cyber Essentials. In the same research, 43% of businesses said they’d identified a cybersecurity breach or attack in the previous 12 months.

At Secarma, we see a cybersecurity gap analysis as a way of turning uncertainty into a practical security plan. Instead of asking, “What security products do we have?”, we’re trying to answer a much more useful question:

Where does our current security posture fall short of the security outcomes our organisation actually needs?

What does a cyber security gap analysis involve?

At its simplest, a gap analysis compares two positions:

1. Current state: the controls, processes and security practices operating across your organisation now.
2. Target state: the position you need to reach based on your risks, regulatory obligations, commercial requirements or chosen security framework.

This approach is built directly into the NIST Cybersecurity Framework 2.0 Profiles guidance. NIST recommends creating a Current Profile and a Target Profile, then comparing the two to identify and analyse gaps. Those findings can then be prioritised according to business requirements and cyber risk.

Your target position won’t necessarily be the same as another organisation’s. An SME preparing for Cyber Essentials may need a very different security gap assessment from a regulated organisation aligning itself with ISO/IEC 27001 or the NCSC Cyber Assessment Framework.

ISO/IEC 27001 itself takes a risk-based approach to managing information security and covers the wider management system around information security rather than technology alone.

The benchmark has to make sense for the organisation using it.

A gap analysis shouldn’t become a checkbox exercise

This is where we think gap analysis is frequently misunderstood.

Imagine your information security policy requires multi-factor authentication for privileged access. During the assessment, the organisation confirms that MFA is “implemented”.

Does that mean the control is working?

Not necessarily.

The useful questions come next. Does MFA cover every privileged account? Are emergency accounts treated differently? Are there legacy systems outside the policy? Can administrators bypass the requirement? Is anyone reviewing exceptions?

A simple yes/no assessment can mark that control as complete while leaving significant exposure behind.

The NCSC deliberately designed its Cyber Assessment Framework around security outcomes rather than a list of prescribed activities. Its guidance explicitly says the approach is intended to discourage assessments from becoming tick-box exercises.

We think the same principle should apply to a broader cybersecurity gap analysis.

For an important security control, we’d want to establish whether it is:

1. defined;
2. actually implemented;
3. consistently enforced;
4. supported by evidence; and
5. tested to establish whether it works as intended.

That final point is particularly important where personal information is involved. ICO guidance on security outcomes explains that UK GDPR security requirements include processes for regularly testing the effectiveness of security measures, while controls should be appropriate to the risks presented by the processing.

A documented control and an effective control aren’t automatically the same thing.

What areas should a security gap assessment cover?

The exact scope should depend on the organisation, but a comprehensive assessment will usually look beyond technical security vulnerabilities.

Depending on your objectives, we may look at areas including:

-governance and cyber risk ownership;

-asset and data visibility;

-identity and access control;

-vulnerability and patch management;

-endpoint, network and cloud security;

-logging and security monitoring;

-incident response and recovery;

-backups and resilience;

-security policies and procedures;

-employee security awareness;

-supplier and third-party risk;

-secure development practices;

-information security controls; and

-applicable cybersecurity compliance gaps.

The NCSC’s CAF takes a similarly broad approach. Its Managing Security Risk objective, for example, covers governance, risk management, asset management and supply-chain security rather than treating cybersecurity solely as a technical problem.

That wider view can uncover weaknesses that a vulnerability scanner alone won’t find.

Cyber security gap analysis vs risk assessment: what’s the difference?

The terms are sometimes used interchangeably, but they answer different questions.

There will naturally be overlap between them. In fact, risk identification should influence how gaps are prioritised.

NIST’s framework guidance makes the same connection by recommending that identified gaps are prioritised according to business requirements and existing risk-management processes rather than simply working through every missing control in numerical order.

This stops a 70-item remediation plan from becoming 70 supposedly equal priorities.

How we approach the gap analysis process

A useful cybersecurity gap analysis should leave you knowing not only where the gaps are, but what you’re going to do about them.

1. Set the scope before assessing anything

First, establish what you’re assessing.

An organisation-wide review might make sense if you’re building a security strategy. Preparation for ISO 27001 certification may instead focus on the defined ISMS scope. A Cyber Essentials readiness exercise has another set of requirements again.

Poor scope creates misleading results because controls can appear effective while important systems, subsidiaries or processes sit outside the assessment.

This point regularly appears in practitioner discussions too. Security professionals working through ISO 27001 gap assessments frequently highlight scope, asset identification and evidence collection as foundational steps rather than starting with a huge control checklist.

2. Establish what is actually happening

Policies and interviews are valuable, but they shouldn’t be the only evidence.

If a process says leavers lose system access immediately, look at whether access-removal records support that claim.

If backups are part of the recovery strategy, confirmation that the backup job completed isn’t the end of the assessment. You need to understand whether restoration has been tested and whether recovery objectives can realistically be met.

The aim is to move from “we have this control” towards “we can demonstrate how this control operates.”

That evidence-based approach is consistent with the UK GDPR’s accountability principle, which requires organisations processing personal data not just to implement suitable measures but to be able to demonstrate them.

3. Identify the size and nature of each gap

Not every finding is a completely absent control.

You may uncover:

-a security control that’s only deployed across part of the environment;

-a process that’s followed but isn’t formally documented;

-a policy that no longer reflects how systems operate;

-a control with no clear owner;

-an exception that’s become permanent; or

-a control that exists but has never been tested.

This gives you considerably more information than a simple “compliant/non-compliant” column.

One useful idea raised by practitioners conducting real-world assessments is to record the control owner, evidence location, review frequency and exception route alongside each finding. It turns the assessment into something teams can operate after the initial review rather than a spreadsheet that gets forgotten.

4. Prioritise by risk, not by gap count

Once the security weaknesses are visible, the next step is prioritisation.

A missing procedure in a low-risk internal system shouldn’t automatically receive the same urgency as weak privileged access protecting business-critical infrastructure.

Look at each gap in context. Which systems does it affect? What could an attacker achieve? What operational process depends on it? Is sensitive or regulated information exposed? Are compensating controls already reducing some of the risk?

The UK Cyber Governance Code of Practice tells boards to identify and prioritise technology, information and services that are critical to organisational objectives and to ensure cyber risks are integrated into wider enterprise risk management.

A remediation plan should follow the same logic.

5. Turn findings into a remediation plan

“Improve access control” isn’t a useful remediation action.

“Enforce MFA across all privileged Microsoft Entra ID accounts and review documented exceptions quarterly” gives someone something they can actually implement and verify.

For each priority gap, the remediation plan should make clear:

-what needs to change;

-who owns the action;

-the target outcome;

-any dependencies;

-the expected completion date; and

-how closure will be verified.

This makes the assessment useful to security teams while giving senior decision-makers a far clearer view of where budget or resource is required.

Don’t close a gap just because the ticket is closed

One of the most useful improvements you can make to the process happens after remediation.

Validate it.

A firewall change request marked complete tells you that somebody changed the firewall. It doesn’t automatically prove the resulting rule behaves as expected.

An incident response plan stored on SharePoint tells you that a document exists. It doesn’t tell you whether the people named in it know what to do during a ransomware incident.

This is where different forms of security assurance can work together. Gap assessments identify where controls need improvement, while technical testing and exercises can establish whether specific defences hold up in practice.

The ICO’s security guidance explicitly includes regular testing of security measures, while the NCSC’s governance guidance places assurance and oversight among the core responsibilities needed for effective cyber governance.

When should you carry out a cybersecurity gap analysis?

There isn’t one universal timetable.

The UK Cyber Governance Code recommends regular risk assessments and says mitigations should account for changes in the organisation, technology, regulation and wider threat landscape.

In practice, a fresh assessment can be particularly useful:

-before pursuing Cyber Essentials or ISO 27001;

-when building or refreshing a cybersecurity strategy;

-following a major cloud migration or infrastructure change;

-after an acquisition or significant organisational change;

-when new regulatory or customer security requirements apply; or

-after an incident exposes weaknesses in existing controls.

It can also help when the security budget has become a long list of competing requests. Understanding the gap between current and target security posture gives you a stronger basis for deciding which improvements should be funded first.

What should you get from the assessment?

The final result shouldn’t just be a list of security vulnerabilities.

You should have a defensible view of your current security posture, the evidence supporting that assessment and a prioritised path towards the position you need to reach.

For technical teams, that creates clearer remediation work.

For CISOs and IT leaders, it provides evidence for investment decisions.

For boards, risk and compliance teams, it translates security weaknesses into issues that can be tracked alongside wider organisational risk.

That’s ultimately where we believe a cybersecurity gap analysis provides the greatest value. It isn’t about collecting the biggest possible list of deficiencies. It’s about establishing which gaps genuinely change your organisation’s exposure and giving you a realistic way to close them.

At Secarma, we combine security consultancy with hands-on testing capabilities, allowing organisations to move from understanding where weaknesses exist to validating whether improvements are actually working. Our approach is focused on practical security outcomes rather than compliance for compliance’s sake.

If you’re unsure where your current security controls stand against the level your organisation needs, a gap analysis gives you a structured place to start.