Gap analysis

As explained in Data-Driven Cybersecurity

Gap analysis is the systematic comparison of a current state with a desired state to identify deficiencies that require remediation.

Gap analysis systematically compares identified cybersecurity risks with existing controls to expose deficiencies, prioritize remediation, and support a more proactive risk-management posture. section 5.6.4

Use gap analysis to:

• Review how well identified control gaps are being closed, typically on a quarterly basis. section 5.6.4
• Incorporate stakeholder input so gap tracking supports a holistic, risk-based approach rather than reactive security work. section 5.6.4
• Pair gap-identification coverage with measures of vulnerability resolution and closure; coverage alone does not prove that deficiencies were mitigated. section 5.6.5

TechGuardian Solutions dashboard

TechGuardian Solutions increased gap-analysis coverage from 60% to 85% toward a 90% quarterly target. Cybersecurity performance problems fell from 20 to 10 incidents per quarter. The results indicate better visibility and fewer incidents, but the dashboard still needs resolution and closure data to demonstrate effective mitigation. section 5.6.5

Figure 5.11 The left side shows TechGuardian Solutions’ gap analysis metrics dashboard before implementing a continuous improvement program. The right side shows the gap analysis metrics dashboard after implementing the program and tracking metrics over time.

Compare the pre-program and post-program dashboard views to see how coverage and performance-problem metrics change over time. section 5.6.5

How Data-Driven Cybersecurity covers it

How deep it goes

Defines risk-control comparison and extends it to quarterly closure tracking, but stops short of proving mitigation through coverage alone.

Examples

Uses a TechGuardian dashboard showing coverage rising from 60% to 85% and performance problems falling from 20 to 10 quarterly.

What it assumes

Assumes a risk assessment and identified controls; teaches comparison, target setting, and verification of closure.

What you can do after

Diagnose control deficiencies by tracking gap coverage alongside vulnerability resolution and closure.

How it connects

Connects risk assessment, cybersecurity controls, stakeholder input, cybersecurity risk management, and continuous improvement.

liveBookmanning.com

Read Data-Driven Cybersecurity on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Think Like a Software Engineering ManagerGap analysis is a technique for identifying differences between a person’s current capabilities and a target role’s requirements.

Compare how 2 books explain gap analysis →

Related concepts

• dashboardused by · A dashboard is a visual interface that consolidates selected data, metrics, or status information for monitoring, analysis, or decision-making.
• delegationused by · Delegation is the assignment or transfer of work, responsibility, or authority to another person, system, or agent to act on behalf of the delegating party.
• leveling guideconfigured by · A leveling guide is an organizational framework that defines roles, responsibilities, expectations, and criteria across job levels.
• individual-contributor-to-engineering-manager transitionuses · The process of moving from a non-managerial individual-contributor engineering role into an engineering-management role.
• security controluses · A security control is a safeguard, policy, or restriction designed to reduce security risks or enforce security objectives.

This explainer was generated by Manning's knowledge graph from the text of Data-Driven Cybersecurity. The section links point to the parts of the book it draws on.