Gap Analysis
- •
def
- •
comparing where an organization currently is against where it wants to be — the "gap" between the two; can require extensive research and take weeks or months
- •
- •
process
- •
choosing the framework — work toward a known baseline, either internal goals or a formal standard (e.g., NIST SP 800-171, ISO/IEC 27001)
- •
evaluate people and processes — baseline employees' experience/training/policy knowledge; examine current IT systems and existing security policies
- •
compare and contrast — evaluate existing systems, identify weaknesses and the most effective processes, via detailed analysis broken into smaller segments
- •
the analysis and report — a detailed baseline and clear view of the current state, plus a path (time, money, change control) to reach the goal; documented in a formal gap analysis report
- •
- •
related