Also known as differential analysis. It is an analysis aimed at finding some deficiency, gap, or difference between the current state and the desired state.

What is GAP analysis?

GAP The analysis is a method used to compare the current state with the desired target state—typically in areas such as cybersecurity, compliance, or IT processes. The result is the identification of so-called “gaps,” meaning areas where changes are needed, protections must be added, or procedures improved. The goal is to gain a clear overview of what is missing in order to reach specific objectives or achieve compliance with a standard.

Where GAP analysis is used in practice

Examples of how companies apply GAP analysis:

• Preparing for certification (e.g., ISO 27001) – identifying which controls are not yet implemented.
• Assessing cybersecurity readiness – e.g., comparing against NIS2 or the Czech Cybersecurity Act.
• Rolling out security policies – spotting missing steps or tools for effective risk management.
• IT infrastructure audits – comparing current setups with internal or industry standards.
• Reviewing incident response readiness – identifying weaknesses in recovery and crisis plans.

GAP analysis isn’t just a compliance tool—it helps prioritize where improvements will have the most impact and reduce risks before they escalate.

GAP analysis vs. related terms

• GAP analysis – identifies differences between current and target states.
• Audit – a formal process assessing compliance with standards or regulations.
• Penetration test – tests for technical vulnerabilities but doesn’t assess alignment with broader frameworks.

The difference lies in focus. A GAP analysis provides a high-level overview of what’s missing to reach a goal. An audit checks whether standards are followed. A pen test finds security holes, but may not link them to strategic goals or compliance requirements. GAP analysis is often the first step in planning changes and investments.

How to implement GAP analysis in your company

Recommended steps:

1. Define your target state – based on selected standards or business objectives.
2. Assess your current state – ideally through internal audit or external review.
3. Identify the gaps – document what’s missing and how it impacts the business.
4. Prioritize findings
5. Create an action plan – with deadlines, responsible owners, and required resources.

Many companies skip this step and jump straight into deploying security tools or processes. That leads to inefficiencies, missed risks, or poor ROI. GAP analysis provides a solid foundation for smarter, more targeted security decisions.