A cyber security gap assessment answers one question with evidence: where does our security actually stand today, and what is the shortest list of fixes that closes the distance to where it needs to be? It is not a penetration test (which attacks your systems to see what breaks), and it is not a compliance audit (which checks whether you followed a prescribed process). A gap assessment maps your current controls against a recognised framework and hands you a prioritised remediation list a business owner can act on.
Here is exactly what goes into one, stage by stage, and what you should receive at the end.
TL;DR
- A gap assessment covers six areas: governance, people, technology controls, data protection, incident response and supplier risk.
- It is measured against a framework - Essential 8, ISO 27001, NIST CSF or SMB1001 - so every finding has a definition of "good".
- The deliverable is a scored report: current state, gaps ranked by risk, and a remediation roadmap with effort estimates.
- Expect it to take days, not months, and to cost a fraction of the incident it prevents.
What gets assessed: the six areas
1. Governance and policy. Who owns security, what the written policies say, and whether anyone follows them. Assessors look for an acceptable use policy, a password and MFA policy, a remote working policy and clear accountability - the documents auditors and insurers ask for first.
2. People and awareness. The human layer that most incidents travel through: whether staff receive regular security training, whether phishing simulations run on a cadence, and whether reporting suspicious emails is a normalised habit. Evidence here is behavioural - click rates, report rates, training completion - not attendance certificates.
3. Technology controls. The technical core: multi-factor authentication coverage, patching cadence, endpoint protection, email filtering, backups and whether they restore, device management, and admin privilege separation. Each control is checked against the framework's maturity levels, not just presence or absence.
4. Data protection. Where sensitive data lives, who can reach it, how it is encrypted in transit and at rest, and what leaves the organisation through email, cloud drives and personal devices.
5. Incident response. What happens in the first hour of a breach: does a written plan exist, has anyone rehearsed it, are contact details current, and is there a defined path for reporting under the Notifiable Data Breaches scheme.
6. Supplier and third-party risk. The vendors with access to your systems and data - what the contracts say about security, whether access is reviewed, and what happens to your data if a supplier is breached.
The framework is the measuring stick
A gap assessment without a framework is an opinion. The framework turns every finding into a defined, defensible level:
| Framework | What it measures | Best fit |
|---|---|---|
| Essential 8 (E8) | Eight Australian government mitigation strategies at four maturity levels | Australian businesses, government suppliers |
| ISO 27001 | A full information security management system | Firms selling to enterprise or international clients |
| NIST CSF | Five functions: identify, protect, detect, respond, recover | US-facing clients, general best practice |
| SMB1001 | A staged certification path built for small and mid-sized businesses | SMBs wanting a certification endpoint |
Mapped findings matter because they convert directly into audit evidence: "Essential 8 maturity level 1 on patching, target level 2 by March" is a statement an auditor, an insurer or an enterprise client can work with.
How the assessment actually runs
- Scoping. Agree the systems, offices and data in scope and pick the framework that matches your obligations and your clients' expectations.
- Evidence collection. A structured questionnaire - completed by you or walked through with the assessor - plus configuration checks and document review. This is where most of the honest answers come from: is MFA enforced or just available, do backups get restore-tested, when did patching last actually happen.
- Scoring. Each control area is scored against the framework's levels, producing your current-state profile.
- The report. Findings ranked by risk, each with a plain-English explanation of what an attacker would do with the gap, a recommended fix, and an effort estimate.
- The roadmap. The remediation list sequenced into quick wins (usually days: enforce MFA, fix backup coverage), medium projects (quarterly) and structural items (annual).
A guided questionnaire plus automated scoring is what keeps the whole cycle to days rather than months. Cyber Aware's cyber security gap assessment runs this flow with framework-mapped questions for Essential 8, ISO 27001, NIST CSF and SMB1001, and compiles the branded report automatically.
What you receive at the end
A good gap assessment report has four sections:
- Current-state scorecard - your maturity level per control area, against the framework.
- Gap register - every finding, ranked by risk, with the business consequence stated in one sentence.
- Remediation roadmap - sequenced fixes with effort and ownership, so the list becomes a plan rather than a shelf document.
- Evidence pack - the mapped findings an auditor or insurer asks for, ready to hand over.
The report should be readable by a non-technical stakeholder - a board, an owner, a client - because that is who funds the fixes.
How it pairs with human risk reporting
The gap assessment measures your controls; the human layer changes faster than any of them. Running the assessment alongside ongoing human risk reporting gives you both halves: where the technical posture stands, and what your people actually do when an attack arrives. Together they answer the full "where are we exposed?" question - and the combination is increasingly what enterprise clients and insurers ask to see.
How often to repeat it
Annually as the baseline, plus after any material change: a new office, a major system migration, a new major client with security requirements, or an incident. The second assessment is the valuable one - it shows whether the roadmap was executed and re-scores the same control areas, so progress is measured rather than asserted.
FAQ
What is the difference between a gap assessment and a penetration test? A penetration test attacks specific systems to find exploitable holes on one occasion. A gap assessment reviews your whole security posture against a framework and produces a prioritised fix list. Mature organisations run both, but the gap assessment comes first because it tells you where to aim.
Do we need a gap assessment if we already have ISO 27001 certification? Yes - certification confirms the management system exists; a gap assessment re-scores the actual control levels and catches drift between audit cycles.
Who should fill in the questionnaire? The person who actually administers each system - not whoever is free. A questionnaire answered from memory produces an optimistic report that fails at the incident.
What if the report makes us look bad? It is confidential, and every organisation's first score is lower than expected. The value is in the trend: report one, fix the roadmap, re-assess.