A gap analysis is one of the simplest and most useful assessments an organisation can carry out before an audit, an inspection or a transformation project. The basic idea is a comparison: what you have now and what you should have, according to a standard or requirement.<\/p>\n\n\n\n
A gap analysis is the right choice when you want to understand the level of compliance and maturity of your existing controls before an audit, a compliance assessment or an inspection. We often carry it out against the NIS2 Directive, the DORA Regulation, ADR requirements for electronic archiving or the Cyber Resilience Act, activating only the requirements relevant to each organisation.<\/p>\n\n\n\n
It is important to know what it is not: a gap analysis is not a certification and does not, in itself, guarantee full compliance. It provides a structured view of the level of alignment and recommendations for remediation.<\/p>\n\n\n\n
We don\u2019t just check whether a policy or procedure exists. For each area, we give two separate scores: documentation maturity and implementation maturity. We use a five-level maturity model, from Initial<\/em> (there is no standardised process) to Optimising<\/em> (the process is continuously monitored and indicators are used for improvement).<\/p>\n\n\n\n The difference matters: an approved procedure that is not applied in practice does not protect the organisation, even if it looks good on paper.<\/p>\n\n\n\n The gap analysis report includes maturity scores by area, a register of gaps against requirements and prioritised recommendations. You get a clear picture of what is missing to achieve compliance or the desired level of maturity, and a concrete basis for the remediation plan.<\/p>\n","protected":false},"excerpt":{"rendered":" A gap analysis compares what you have now with what you should have. Here is how it works, how maturity is measured and what you get at the end.<\/p>\n","protected":false},"author":1,"featured_media":2676,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24],"tags":[],"class_list":["post-2646","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audit-and-compliance"],"_links":{"self":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts\/2646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/comments?post=2646"}],"version-history":[{"count":1,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts\/2646\/revisions"}],"predecessor-version":[{"id":2654,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts\/2646\/revisions\/2654"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/media\/2676"}],"wp:attachment":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/media?parent=2646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/categories?post=2646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/tags?post=2646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}How it works<\/h2>\n\n\n\n
\n
What you get at the end<\/h2>\n\n\n\n