{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/gap-analysis","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/gap-analysis/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/gap-analysis/"},"term":{"en":"Gap analysis","da":"Gap-analyse"},"aka":{"en":["gap assessment"],"da":["gap-vurdering"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","summary":{"en":"A comparison of what an organisation does today with the requirements it wants to meet.","da":"En sammenligning af, hvad en organisation gør i dag, og de krav, den ønsker at leve op til."},"body":{"formal":{"en":"A structured review that holds current practice against each requirement of a chosen law, standard or framework, records each requirement as met, partly met or missing, and ranks the gaps by risk and effort into an action plan.","da":"En struktureret gennemgang, der holder den nuværende praksis op mod hvert krav i en valgt lov, standard eller et rammeværk, noterer hvert krav som opfyldt, delvist opfyldt eller manglende og prioriterer hullerne efter risiko og indsats i en handlingsplan."},"plain":{"en":"Holding your half-packed suitcase against the packing list to see what you still need to buy before the trip.","da":"At holde den halvt pakkede kuffert op mod pakkelisten for at se, hvad man stadig mangler at købe inden rejsen."},"inPractice":{"en":"A consultant sits down with the operations manager of a Danish water utility, goes through the NIS2 minimum requirements one by one and finds that no logs are kept and suppliers face no security terms; the result becomes a 12-month plan for the board.","da":"En konsulent sætter sig med driftslederen på et dansk vandværk, gennemgår NIS2-minimumskravene ét for ét og finder, at der ikke gemmes logs, og at leverandørerne ikke er underlagt sikkerhedskrav; resultatet bliver en 12-måneders plan til bestyrelsen."},"whyItMatters":{"en":"Without it, time and money go to whatever feels urgent rather than the biggest holes, and there is no baseline to show progress to management or an authority later.","da":"Uden den går tid og penge til det, der føles mest presserende, frem for de største huller, og der er intet udgangspunkt at vise fremskridt ud fra over for ledelsen eller en myndighed."}},"deepDive":{"en":"A gap analysis has three inputs: a requirement baseline, an assessment scale and evidence of current practice. The baseline must be decomposed to testable statements; NIS2 Art. 21(2) lists ten measure areas, (a) risk analysis and security policies through (j) MFA and secured communications, but each needs to be broken down, for example using Commission Implementing Regulation (EU) 2024/2690 for the digital-infrastructure and digital-service entities it covers, or national guidance, before it can be scored. ISO/IEC 27001:2022 is usually assessed clause by clause for 4-10 plus the 93 Annex A controls; NIST CSF 2.0 (February 2024) formalises the approach as a comparison between a Current Profile and a Target Profile across its six functions, now including Govern.\n\nScales range from binary (met/not met) through three-level (met, partial, missing) to maturity models on a 0-5 scale inspired by CMMI, where for example 0 means non-existent, 1 ad hoc, 2 repeatable, 3 defined, 4 managed and measured, and 5 optimised. The choice matters: binary scales hide progress, while maturity scales invite inflated self-scoring unless each level has explicit evidence criteria. A robust assessment records, per requirement, the current state, the evidence reviewed, the target state, the gap description, a risk rating of the gap and an estimated effort, so that prioritisation can be done on risk reduction per unit of effort rather than on perceived urgency.\n\nEvidence depth distinguishes a gap analysis from an audit. Gap analyses are usually interview- and document-based and performed by the organisation or a consultant as advisory work, without formal sampling or independence requirements. That makes them fast, but also prone to \"paper compliance\": a policy exists, so the requirement is scored as met although nobody follows it. Spot checks of records, such as a sample of user access reviews or restore-test logs, sharply improve reliability. It also differs from a risk assessment: a gap analysis measures distance to a requirement set, whereas a risk assessment measures exposure to threats; a gap on a low-risk requirement may rightly be accepted, and a fully compliant organisation can still carry significant risk.\n\nThe output feeds planning: in ISO 27001 terms it informs 6.1.3 risk treatment and 6.2 objectives, and in practice it is converted into a compliance roadmap. Re-running the same assessment at fixed intervals, typically annually or before a certification or supervisory audit, turns it into a measurement of progress in the Check phase of PDCA. Scoping errors are the commonest failure: assessing only the IT department when NIS2 or ISO 27001 scope covers the whole organisation, or omitting outsourced services that still fall under the entity's responsibility.","da":"En gap-analyse har tre input: et kravgrundlag, en vurderingsskala og dokumentation for den nuværende praksis. Kravgrundlaget skal brydes ned i udsagn, der kan testes; NIS2 art. 21, stk. 2, opregner ti områder for foranstaltninger, fra a) risikoanalyse og sikkerhedspolitikker til j) MFA og sikret kommunikation, men hvert område skal nedbrydes, fx med Kommissionens gennemførelsesforordning (EU) 2024/2690 for de enheder inden for digital infrastruktur og digitale tjenester, den dækker, eller national vejledning, før det kan vurderes. ISO/IEC 27001:2022 vurderes typisk punkt for punkt for 4-10 plus de 93 Annex A-kontroller; NIST CSF 2.0 (februar 2024) formaliserer metoden som en sammenligning mellem en nuværende profil og en målprofil på tværs af de seks funktioner, nu inklusive Govern.\n\nSkalaerne spænder fra binære (opfyldt/ikke opfyldt) over tre niveauer (opfyldt, delvist, mangler) til modenhedsmodeller på en skala fra 0 til 5 inspireret af CMMI, hvor fx 0 betyder ikke-eksisterende, 1 ad hoc, 2 gentageligt, 3 defineret, 4 styret og målt og 5 optimeret. Valget har betydning: binære skalaer skjuler fremskridt, mens modenhedsskalaer frister til for høj selvvurdering, medmindre hvert niveau har klare krav til dokumentation. En robust vurdering registrerer for hvert krav den nuværende tilstand, den gennemgåede dokumentation, måltilstanden, beskrivelsen af hullet, en risikovurdering af hullet og en anslået indsats, så prioriteringen kan ske efter risikoreduktion pr. indsats frem for oplevet hastværk.\n\nDybden af bevisførelsen adskiller en gap-analyse fra en audit. Gap-analyser er typisk baseret på interview og dokumenter og udføres af organisationen selv eller en konsulent som rådgivning, uden formelle krav til stikprøver eller uafhængighed. Det gør dem hurtige, men også sårbare over for \"papir-compliance\": der findes en politik, så kravet vurderes som opfyldt, selv om ingen følger den. Stikprøver i registreringer, fx et udsnit af gennemgange af brugeradgange eller logs fra gendannelsestest, øger pålideligheden markant. Den adskiller sig også fra en risikovurdering: en gap-analyse måler afstanden til et kravsæt, mens en risikovurdering måler eksponeringen for trusler; et hul i et lavrisikokrav kan med rette accepteres, og en fuldt compliant organisation kan stadig bære betydelig risiko.\n\nResultatet føder planlægningen: i ISO 27001-termer indgår det i risikohåndteringen efter 6.1.3 og målene efter 6.2, og i praksis omsættes det til en compliance-køreplan. Gentages samme vurdering med faste mellemrum, typisk årligt eller før en certificerings- eller tilsynsaudit, bliver den en måling af fremskridt i Check-fasen af PDCA. Fejl i afgrænsningen er den hyppigste faldgrube: man vurderer kun IT-afdelingen, selv om NIS2- eller ISO 27001-omfanget dækker hele organisationen, eller udelader outsourcede tjenester, som enheden stadig har ansvaret for."},"edges":[{"type":"requires","to":"security/compliance","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/nis2-minimum-requirements","why":{"en":"The minimum requirements are a common yardstick for a gap analysis.","da":"Minimumskravene er en almindelig målestok for en gap-analyse."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/pdca","why":{"en":"A gap analysis feeds the Plan step and is repeated in Check to measure progress.","da":"En gap-analyse føder Plan-trinnet og gentages i Check for at måle fremskridt."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"security/nist-csf","why":{"en":"Comparing a current profile with a target profile is a gap analysis.","da":"At sammenligne en nuværende profil med en målprofil er en gap-analyse."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/iso-27001","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/self-assessment","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 3","tier":"course-material"}],"draft":true}