A gap analysis is one of the simplest and most useful assessments an organisation can carry out before an audit, an inspection or a transformation project. The basic idea is a comparison: what you have now and what you should have, according to a standard or requirement.
When a gap analysis makes sense
A gap analysis is the right choice when you want to understand the level of compliance and maturity of your existing controls before an audit, a compliance assessment or an inspection. We often carry it out against the NIS2 Directive, the DORA Regulation, ADR requirements for electronic archiving or the Cyber Resilience Act, activating only the requirements relevant to each organisation.
It is important to know what it is not: a gap analysis is not a certification and does not, in itself, guarantee full compliance. It provides a structured view of the level of alignment and recommendations for remediation.
Documentation and implementation, assessed separately
We don’t just check whether a policy or procedure exists. For each area, we give two separate scores: documentation maturity and implementation maturity. We use a five-level maturity model, from Initial (there is no standardised process) to Optimising (the process is continuously monitored and indicators are used for improvement).
The difference matters: an approved procedure that is not applied in practice does not protect the organisation, even if it looks good on paper.
How it works
- Initiation and scope definition – we establish the applicable obligations and the systems, processes and vendors in scope.
- Requirements mapping – we turn legal requirements into control criteria and assessment questions.
- Information gathering – we review documentation, hold interviews and check evidence and configurations.
- Maturity assessment – we score each area and identify the gaps against the target level.
- Gap analysis and prioritisation – we identify deficiencies, their causes and impact, and set remediation priorities.
- Reporting – we consolidate the conclusions and present them to management.
What you get at the end
The gap analysis report includes maturity scores by area, a register of gaps against requirements and prioritised recommendations. You get a clear picture of what is missing to achieve compliance or the desired level of maturity, and a concrete basis for the remediation plan.
