Gap Analysis 1.2

Question 1

What is a gap Analysis?

Answer 1

Where you compare where you want to be with where you are. Requires doing extensive research.

Can take weeks or months. Extensive study with numerous participants. Emails, data gathering, and technical research.

Question 2

Choosing the framework

Answer 2

Work towards a baseline. May be an internal set of goals. Some orgs should use formal standards.

Determine the end goal. ex- NIST special publication 800-171 revision 2, protecting controlled unclassified information in nonfederal systems and organizations. ISO/IEC 27001, Information security management systems.

Question 3

Evaluate people and processes

Answer 3

Get a baseline of employees. Formal experience, current training, knowledge of security policies and procedures.

Examine the current processes. Research existing IT systems. Evaluate existing security policies.

Question 4

Compare and contrast (See example on Vid)

Answer 4

Evaluate existing systems.

Identify weaknesses along with the most effective processes.

A detailed analysis that examines broad security categories and breaks those into smaller segments.

Question 5

The analysis and report (see video)

Answer 5

The final comparison shows detailed baseline objectives. A clear view of the current state.

Need a path to get from the current security to the goal. This will almost certainly include time, money, and lots of change control.

Time to create the gap analysis report. A formal description of the current state and recommendations for meeting the baseline.