Measured against your framework. Ranked by your risk.
HIPAA, GLBA, NIST CSF, SOC 2, ISO 27001, PCI DSS, NIST SP 800-171 or the standard your customers ask about. We assess your program against the framework you answer to. If you already have a program, we map what you have back to it, then fill the gaps, ranked by business risk so you fix what matters first.
- Frameworks
- NIST CSF, HIPAA, GLBA, SOC 2, ISO 27001 and more
- Starts from
- The program you already have
- Gaps ranked by
- Business risk, not a checklist
- You leave with
- A gap register and a plan
What makes it different
Not a checklist. A plan.
Most gap assessments hand you a long list of items marked not met, with no sense of which ones matter. We score every gap with your risk methodology, so the list becomes a short, ordered plan your leadership can fund.
Mapped, not redone
Credit for what you have.
We map your existing policies, controls and evidence back to the framework, so you only build what is actually missing.
Risk-ranked
Fix what matters first.
Every gap is scored by business impact, not just pass or fail, so effort and budget go where they count.
Industry-aware
We know your rulebook.
Higher education, financial services, technology, healthcare, manufacturing, government, nonprofits and legal. We know the standards each one answers to.
The problem
Why gap assessments stall.
The report arrives, and nothing much changes.
- Hundreds of findingsEvery requirement marked met or not met, with no priority.
- Starting from zeroExisting work ignored, so teams rebuild what they already have.
- Framework soupOverlapping requirements from several standards, tracked separately.
- No business caseGaps that leadership cannot weigh against cost.
- Written for the auditorA report for the file, not for the people fixing things.
How it works
Map, measure, rank, plan.
A focused engagement that starts with what you already have.
- 01
Scope the framework
Agree which standards apply, and to which systems, data and locations.
- One framework or several at once
- Regulatory, contractual or voluntary
- 02
Map what you have
Collect your existing policies, controls and evidence and map them to each requirement.
- 03
Assess the gaps
Interviews and evidence review to confirm what is in place, partial or missing.
- 04
Rank by risk
Score each gap with your risk methodology, so the list becomes an order of work.
- 05
Plan the fix
A practical roadmap with owners, effort and cost, ready for leadership.
- 06
Fill the gaps
Optional hands-on help with control standards, policies and implementation.
What is changing
The FFIEC CAT is retired. Banks and credit unions now need a framework crosswalk to NIST CSF 2.0 or the CRI Profile. See how we map your program and rank the gaps.
NYDFS now requires MFA everywhere and a formal asset inventory. Sections 500.12 and 500.13 took effect November 1, 2025. See how our data governance process builds the inventory.
Industries we know well
Higher Education, Financial Services, Technology, Healthcare, plus manufacturing, government, nonprofit and legal organizations. We know the standards each one answers to, and score every finding with your risk methodology. Every other industry
Who it's for
Ready for the auditor. Useful for the business.
For leadership and compliance
Know where you stand against the rules.
- One viewEvery applicable framework in one gap register.
- PrioritizedSpend on the gaps that carry real risk.
- DefensibleA documented basis for every decision.
For it and security teams
Know exactly what to fix, and in what order.
- Credit for existing workWhat you have is mapped, not redone.
- Clear next stepsOwners, effort and order for each gap.
- Less duplicationOne control can satisfy several frameworks.
What you get
Gap Assessment deliverables.
Concrete artifacts you keep, not a slide deck that disappears after the readout.
- 01
Framework mapping
Your current program mapped to each requirement.
- 02
Gap register
Every gap, its status and the evidence behind it.
- 03
Risk ranking
Gaps scored with your risk methodology.
- 04
Remediation roadmap
Owners, effort and order of work.
- 05
Executive summary
Where you stand, in business terms.
- 06
Evidence index
What an auditor will ask for, and where it lives.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →Connected services