Fundamentals of Information Systems Security, 4th Edition

Closing the Information Security Gap

Despite best efforts, no collection of security controls is perfect, and there are always some vulnerabilities for which there are no controls. The difference between the security controls that are in place, as outlined in the security policy (i.e., defines risk-mitigating solutions for an organization), and the controls that are necessary to address all vulnerabilities is called the security gap, which is determined by conducting a gap analysis.

Gap analysis activities should be ongoing and should consist of regular reviews of day-to-day practices vis-à-vis the latest threat assessment. Threats that you do not address through at least one control indicate gaps in the security.

Performing gap analysis is ...