Definition

Gap analysis

A gap analysis compares where your controls stand today against where a standard or framework requires them to be, then lists the differences you must close. The output is a practical punch list: which policies are missing, which controls exist but lack evidence, and which processes need to change before an audit. It usually kicks off a compliance project because it turns a broad requirement like SOC 2 or ISO 27001 into concrete, assignable tasks. A good gap analysis also ranks the findings by effort and risk, so your team fixes the items that block certification first and tackles the polish later.