Gap assessment
A comparison of current practice against a target framework, producing a prioritized list of what is missing.
It answers the practical question of how far you are from compliant and in what order to close the distance. It is the sensible first step before any certification effort.
A useful one separates quick configuration fixes from genuine projects, because conflating them produces a plan that stalls in the first month.
Where this comes up
Gap assessment sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Risk assessment A structured evaluation of what could go wrong, how likely it is, what it would cost, and what you will do about it. Plan of action and milestones A documented plan for closing known compliance gaps, with owners and target dates. Security control A specific safeguard put in place to reduce risk, whether technical, administrative, or physical. SOC 2 An audit report on how a service organization controls customer data, assessed against the Trust Services Criteria.