Run a gap analysis against a standard you did not write

applied · 80 min · Objective 5.1

Task

Take an external standard, measure your lab estate against it, and produce the finding list with owners and dates. A gap analysis needs a named target, and using somebody else's standard is what stops it being a list of things you already intended to do.

Steps

  1. Choose the target and name it explicitly: a published benchmark, an ISO 27001 Annex A control set, or the CIS Controls. Write the exact version into /tmp/gap.md — 'best practice' is not a target.
  2. Select twenty controls from it that apply to your estate. Include some you know you will fail.
  3. Measure each against the estate, by running a command or inspecting configuration rather than by recalling what you set up. Record met, partial or not met with the evidence.
  4. For every gap, write the remediation, an owner, an effort estimate and a target date.
  5. Sort the gaps by risk rather than by effort, and mark the three you would do first.
  6. Record the two figures that make this a gap analysis rather than a list: the percentage of controls met, and the number of gaps with no owner — which must be zero.

Verify

awk -F, 'NR>1 {n++} END {print n" control(s) assessed"}' /tmp/gap.csv
python3 - <<'PY'
import csv,re
rows=list(csv.DictReader(open('/tmp/gap.csv')))
assert len(rows)>=20, 'fewer than twenty controls assessed'
states={r['status'].strip().lower() for r in rows}
print('statuses used:',states)
assert 'not met' in states or 'partial' in states, 'everything passed - the control selection avoided the gaps'
gaps=[r for r in rows if r['status'].strip().lower()!='met']
noowner=[r for r in gaps if not r['owner'].strip()]
assert not noowner, '%d gap(s) with no owner' % len(noowner)
nodate=[r for r in gaps if not re.search(r'\d{4}-\d{2}-\d{2}', r['target_date'])]
assert not nodate, '%d gap(s) with no target date' % len(nodate)
print('%d controls, %d gaps, every gap owned and dated' % (len(rows),len(gaps)))
PY
grep -ciE "version|edition|published" /tmp/gap.md

The assertions enforce what separates a gap analysis from a wish list: a named target with a version, at least some genuine failures, and every gap carrying an owner and a date. A gap analysis where everything passed measured the controls you already had rather than the standard.

Notes

The percentage met is the number that gets quoted and the number of unowned gaps is the one that matters. A 78% score with twelve unowned gaps describes an organisation that knows what is wrong and has not decided to fix any of it, which is a governance failure rather than a technical one.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.