- Home
- Assessments & Advisory
- Gap assessment
Know where you stand,
and the order to close the gaps.
We map your controls to the frameworks and regulations you answer to, test whether they work in practice, and hand you a phased roadmap ranked by business impact, with policies you can adopt on day one. Our assessment platform cross-maps 87 frameworks from the UAE, North America, the United Kingdom, the EU and international standards bodies.
An evidence-based measure, not a checkbox exercise.
A gap assessment measures your security programme against the frameworks that matter to your organization and your regulators. We do not stop at whether a policy exists. We interview the people who run each control, review the configuration behind it and, where it matters, test it, so the gaps we report are the ones that are real.
Every control domain is scored on a maturity scale from initial to optimized, current state against target state. The distance between the two drives a phased roadmap that sequences the work by risk reduction, effort, dependencies and quick wins, so leadership can fund it in a sensible order and your auditor can see the evidence trail.
- A control-by-control map against your chosen frameworks, cross-referenced across all 87 so one fix closes several requirements
- A gap analysis with each finding ranked by business impact, not just severity
- A maturity scorecard per domain, current state against target, ready for the board
- Ready-to-adopt policies and standards for the gaps that are missing paperwork
- A phased remediation roadmap with owners, dependencies and quick wins
- An executive briefing to walk leadership through the findings and the plan
Four steps, interviews to roadmap.
Scope the frameworks
We agree the standards and regulations in play, your target maturity and the business units in scope.
Gather evidence
Structured interviews with IT, security, operations and leadership, plus policy and documentation review against each requirement.
Validate the controls
Configuration review, architecture and segmentation analysis, and process observation to check that documented practice matches actual practice.
Score and sequence
Each domain is scored, gaps are ranked by business impact, and the roadmap, policies and executive briefing are delivered.
87 frameworks,one assessment.
Controls are cross-mapped across every framework, so one control and one piece of evidence satisfy every requirement it touches. You only answer the questions that apply to the frameworks you select and the industry you are in.
| Category | Frameworks |
|---|---|
| United States | NIST CSF 1.1 and 2.0, NIST SP 800-53, 800-171 and 800-172, CMMC Levels 1 and 2, CJIS, DFARS, ITAR, DISA STIG, DoD Zero Trust, FFIEC, NYS DFS, SEC cybersecurity, FTC Safeguards, HIPAA Security, HITRUST, CCPA |
| United Kingdom | NCSC CAF 4.0, Cyber Essentials Plus 2026, the Cyber Security and Resilience Bill, FCA/PRA operational resilience, the Critical Third Parties regime, NHS DSPT v8, the Data (Use and Access) Act 2025, UK AI governance, UK GDPR |
| United Arab Emirates | UAE IA Regulation, DESC ISR, ADHICS, UAE PDPL, CBUAE requirements |
| European Union | GDPR, NIS2, DORA, EU AI Act |
| International and cross-sector | ISO/IEC 27001:2013 and 2022, ISO/IEC 42001, NIST AI RMF, CIS Controls v8, PCI DSS 4.0.1, SOC 2, NIST SSDF, ISO/SAE 21434, ICS cyber security |
Automated where it can be,evidenced where it counts.
Automated checks plus questionnaire
Automated security assessments run alongside a structured questionnaire, so what you say is checked against what your environment shows.
Scoped to you
Questions are filtered by the frameworks you select and by your industry, one of 20 mapped, so nobody answers what does not apply.
Evidence attached
Supporting documents are uploaded against each answer, so every finding traces back to proof your auditor can see.
Live SaaS posture
Real-time SaaS security posture feeds into the assessment, so cloud controls are measured as they are today, not as documented.
AI-assisted analysis
Responses and evidence are analysed to surface gaps and draft findings, which our assessors review before anything reaches you.
Reports and a client portal
Branded reports and secure sharing through a client portal, so findings reach the people who need them without email attachments.
Four moments a gap assessment pays for itself.
Before an audit
Find the gaps on your schedule, not the auditor's.
A certification goal
Know the distance to ISO 27001 or SOC 2 before you commit to a date.
A board asking for a plan
Replace "we are working on it" with a scored baseline and a funded sequence.
A new security leader
Give a new CISO or vCISO an objective starting point.
Who it is for
Organizations with an audit coming, a certification goal, or a board asking for a security plan, and anyone who needs to show regulators or insurers that their gaps are known and being closed in a defensible order.
- vCISO, someone senior to own the roadmap
- Microsoft security assessment, the same rigour applied to your tenant
- GRC & compliance, Forseti, close the gaps and carry them to audit
- Vulnerability assessment, the technical weaknesses under the controls
What buyers ask.
We already know we have gaps.
Then you need the order to close them in and the evidence your auditor will ask for. That is what this produces: a ranked, phased roadmap and a scored baseline you can show progress against.
Isn't this just an audit by another name?
No. An auditor tells you what is wrong and is not permitted to fix it. We measure, rank and give you the policies and roadmap to close the gaps, and Forseti can carry the work through to the audit.
We follow several frameworks. Do we need several assessments?
No. We cross-map the frameworks so one control and one piece of evidence satisfy every requirement it touches.
Will this tie up my team for weeks?
The interviews are scheduled and short, and most of the evidence review happens on our side. Your team's time goes on answering questions, not producing documents for us.
What does a gap assessment cost?
It is quoted to your scope: the frameworks, the number of sites and the size of your environment. Scoping the quote is no charge. Request pricing.
Start with the facts. Then build the plan.
Book a gap assessment and we will scope the frameworks, the timeline and the deliverables with you on the first call. Scoping is no charge and no commitment.