Published · By the Aesparrow Security Research Team
Short answer
A compliance gap assessment compares your current policies, controls and evidence against the requirements of a standard or regulation, rates each gap by risk, and produces a prioritised remediation roadmap. It is the first step of compliance implementation for ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR or NIST.
What is the difference between a compliance assessment and a compliance audit?
A compliance assessment (or readiness assessment) is advisory: it identifies gaps and recommends fixes. A compliance audit is a formal evaluation — by an internal auditor or an external certification body — that tests whether requirements are met and records findings or issues a certificate.
Compliance readiness checklist
- Scope defined: systems, data, locations and teams in scope.
- Policies approved: information security and supporting policies.
- Risk assessment completed: with treatment plan and owners.
- Controls implemented: access control, logging, encryption, backups, vulnerability management.
- Evidence collected: records that controls operate over time.
- VAPT performed: recent penetration test with findings remediated.
- Training delivered: security awareness for all staff.
- Internal audit done: and corrective actions closed.
How to perform a compliance gap assessment
- 1Select the framework and scopeConfirm which standard applies and which systems and teams are in scope.
- 2Build the requirement listBreak the standard into testable requirements and controls.
- 3Gather evidenceInterview owners, review documents and inspect systems.
- 4Rate each gapClassify as met, partially met or not met, and rate the risk.
- 5Create the remediation roadmapPrioritise fixes with owners, effort and deadlines.
- 6Re-assess before the auditVerify that gaps are closed and evidence is ready.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
How long does a compliance gap assessment take?
Usually one to three weeks, depending on the framework and scope.
What is a compliance gap assessment report?
A document listing each requirement, current status, gap description, risk rating and recommended remediation, with an overall readiness score.