Compliance Gap Analysis: How to Identify and Fix Security Gaps

A compliance gap analysis is a structured comparison between what your business currently does and what a regulation, framework, or standard actually requires. It tells you exactly where your policies, controls, or documentation fall short and gives you a prioritised list of what to fix first. For small businesses juggling security, operations, and everything in between, it’s usually the fastest way to find out where you’re exposed before an auditor, customer, or attacker finds out for you.

What Is a Compliance Gap Analysis?

A compliance gap analysis compares your current security controls, policies, and documentation against the specific requirements of a framework, ISO 27001, SOC 2, PCI DSS, the NZ Privacy Act 2020, or the AU Privacy Act 1988, for example. The output isn’t a vague impression of “pretty good” or “needs work.” It’s a documented list of specific gaps, each one tied to a requirement you’re not fully meeting.

What does “gap” mean in compliance?

A gap is any control, policy, or piece of documentation your business doesn’t have or has, but can’t evidence that a framework requires. Common examples include:

• No multi-factor authentication on administrator accounts
• An incident response plan that exists but was never tested
• Security awareness training that’s overdue or undocumented
• A backup policy with no record of a recent restore test
• Vendor contracts with no written security requirements

Each of these is a compliance gap, whether or not anyone in the business has actually noticed yet.

Compliance Gap Analysis vs. Risk Assessment

A compliance gap analysis and a risk assessment are not the same exercise, though they’re routinely confused. A compliance gap analysis checks whether you meet a specific, named standard. A risk assessment estimates what could go wrong and how much damage it would cause, regardless of whether that risk maps to any regulation at all.

In practice, most mature security programmes run both, but if you’re preparing for a specific audit, certification, or customer due diligence request, gap analysis is where to start. It tells you precisely where you stand against the requirement someone is about to check.

Why Compliance Gaps Are Common in Small Businesses

Small businesses fall behind on compliance mainly because gap analysis doesn’t feel urgent until something forces the issue, such as an audit, a customer questionnaire, or an incident. Without one of those triggers, it’s easy to assume existing security measures are “probably fine.”

That assumption is risky. Very few small firms run proactive security audits or regular vulnerability scans, which means most operate without a clear picture of their own gaps. Attackers exploit exactly this: automated scanning tools are built to find unpatched systems, missing MFA, and other unchecked exposure quickly, and they don’t discriminate by business size. For a closer look at where these gaps tend to show up, see our breakdown of the cybersecurity challenges facing small businesses.

For NZ and AU businesses specifically, this isn’t just a security question. The NZ Privacy Act 2020 carries mandatory breach notification obligations, and being able to show what controls you had in place, or didn’t have, matters if you’re ever asked to explain a breach to the Privacy Commissioner or affected customers.

How to Perform a Compliance Gap Analysis? (Step by Step)

Here’s the process, broken into six practical steps.

1. Define your framework and scope

Start by naming exactly what you’re measuring against ISO 27001, SOC 2, or the NZ Privacy Act 2020, for instance, and which parts of the business are in scope. A gap analysis with no defined boundary produces a list too long to act on.

2. Gather your current policies, controls, and evidence

Pull together what you already have: security policies, access logs, risk assessments, vendor agreements, and training records. This becomes your baseline, and it’s often where the first surprises show up: policies that were written once and never updated, or controls that exist informally but were never documented.

3. Compare your current state against the required state

Go requirement by requirement and mark each one: compliant, partially compliant, non-compliant, or not applicable. This is the core of the exercise, and it’s where vague impressions turn into a specific, defensible list.

4. Log every gap in a structured template 

Don’t just note that something’s missing; record the requirement, the current state, the severity, and who owns fixing it. The template section below covers exactly what to include.

5. Build a prioritised remediation roadmap

Not every gap deserves the same urgency. A missing MFA requirement on privileged accounts is a different priority than a policy document that’s a few months overdue for review. Rank by risk and business impact, not by how easy each fix is.

6. Assign ownership and re-test

A gap analysis that identifies problems but never confirms they were fixed hasn’t actually done its job. Closing a gap “on paper” isn’t the same as confirming the control now works, assigning a named owner to each item and checking back. This is also where ongoing monitoring, such as a managed detection and response service, earns its keep: it keeps controls operating continuously instead of just being documented once and forgotten.

Common Compliance Gaps in NZ and AU Small Businesses

A few gaps show up again and again in businesses with 1–50 staff, regardless of industry:

• MFA gaps: Enabled for standard users, but administrator and privileged accounts were left out
• Untested backups: A backup routine exists, but nobody has actually confirmed it restores cleanly
• Undocumented incident response: The team knows roughly what to do, but there’s no written plan naming who does what
• Training gaps: Awareness training runs, but completion isn’t tracked against a required threshold
• Vendor gaps: Third-party contracts with no written security or data-handling clauses

These are exactly the kind of gaps a proper endpoint security checklist is built to catch before an auditor does, worth running through device by device rather than assuming coverage. 

Compliance Gap Analysis Template: What to Include

You don’t need specialised software to start. A simple spreadsheet with these columns covers most of what an auditor or a customer’s security team will expect to see:

• Requirement: The specific clause or control from the framework
• Source: Which regulation or standard does it come from
• Current state: What you actually have in place today
• Gap identified: Yes/no, and a short description
• Gap type: Missing control, partial control, undocumented control, or outdated control
• Severity: High, medium, or low
• Owner: The named person accountable for closing it
• Target date: A realistic deadline, not a placeholder

Keeping this in one place, updated as gaps close, turns a one-off exercise into something you can actually track over time.

How CyberMark Helps Close Compliance Gaps?

Most compliance providers hand over a report listing your gaps and leave you to fix them alone. That’s not particularly useful if you don’t have a dedicated compliance team.

Our compliance assessments run at $500 NZD per framework and include a full questionnaire, a review from a compliance officer, and a detailed report. But the more important part is what happens after: because we also deliver managed security services, remediation can happen through the same provider that identified the gaps in the first place. Controls actually get implemented, not just documented. If you’re weighing which framework to start with or want a clearer picture of your current gaps, our compliance reporting service is a practical next step.

Frequently Asked Questions

How do you do a security gap analysis? 

A security gap analysis follows the same process as a compliance gap analysis, comparing current controls against a required standard. Still, it can be broader, covering general security posture rather than a specific regulation. In practice, most businesses run it against a specific framework anyway, since that’s what gives the results something concrete to act on.

What are the 4 steps of gap analysis? 

At a minimum, define the standard you’re measuring against, assess your current controls, compare the two to identify gaps, and build a plan to close them. The six-step process above breaks this down further for practical use.

What does “gap” mean in compliance? 

A gap is any requirement in a regulation or standard that your current policies, controls, or documentation don’t fully satisfy, whether it’s missing entirely, partially in place, or in place but undocumented.

What are the 5 key areas of compliance? 

In cybersecurity compliance specifically, the five core areas are Identify, Protect, Detect, Respond, and Recover, understanding your data and risk, implementing controls that prevent breaches, monitoring for threats, having a response process, and being able to restore operations afterward.

What is the ITIL gap analysis? 

ITIL gap analysis is a broader IT service management technique used to compare current IT processes against a target operating model; it’s not specific to regulatory compliance. It shares the same basic “current state vs. desired state” structure, but it’s typically applied to service delivery rather than a named compliance framework.

How often should you run a compliance gap analysis? 

At least once a year, and additionally before any scheduled audit, after a security incident, or whenever a relevant regulation changes. Waiting longer than 12 months between reviews usually means the results are already out of date by the time you look at them again.

Start Closing Your Compliance Gaps

A compliance gap analysis only creates value once the gaps it finds actually get fixed. The businesses that treat it as a one-time report tend to end up back in the same position a year later; the ones that treat it as a recurring process are the ones that walk into an audit, a customer questionnaire, or a cyber insurance renewal with real answers instead of guesses.

If you’ve never run a formal gap analysis, start small: pick one framework, work through the six steps above, and log what you find in a simple template. You’ll likely uncover more than expected on the first pass; that’s normal, and it’s the whole point.

If you’d rather have a compliance specialist run this process for you, get in touch with our team for a straightforward look at where your business currently stands.