The Art of War

1 card

1. 01

   A useful gap analysis compares the requirement with the evidence that exists, not with intent: what the standard asks, what you have, who closes the difference and by when.

   The Art of War · 1910

   A gap analysis without owners and deadlines is a list of regrets.

   The standard explicitly requires documented information in fourteen places: the scope (4.3), the policy (5.2), the risk assessment process (6.1.2), the risk treatment process and the Statement of Applicability (6.1.3), the objectives (6.2), evidence of competence (7.2), evidence that processes were carried out as planned (8.1), the results of risk assessments (8.2), the results of treatment (8.3), monitoring and measurement results (9.1), the internal audit programme and its results (9.2), the results of management reviews (9.3) and, at 10.2, the nature of nonconformities, the actions taken and their results. On top of those come the documents required by the controls kept in the Statement: topic-specific policies, the inventory of information and other associated assets, acceptable use rules and the rest. A good gap analysis has one line per requirement and three columns: what the standard asks, what evidence exists today and where, then the verdict — conforming, partial or absent, with an owner and a deadline. Percentages without owners close nothing.

   “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

   Open the card →