“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”Sun Tzu, traducere Lionel Giles · The Art of War · 1910 · The Art of War, traducerea Lionel Giles (1910), cap. III «Attack by Stratagem», §18
A gap analysis without owners and deadlines is a list of regrets.
The standard explicitly requires documented information in fourteen places: the scope (4.3), the policy (5.2), the risk assessment process (6.1.2), the risk treatment process and the Statement of Applicability (6.1.3), the objectives (6.2), evidence of competence (7.2), evidence that processes were carried out as planned (8.1), the results of risk assessments (8.2), the results of treatment (8.3), monitoring and measurement results (9.1), the internal audit programme and its results (9.2), the results of management reviews (9.3) and, at 10.2, the nature of nonconformities, the actions taken and their results. On top of those come the documents required by the controls kept in the Statement: topic-specific policies, the inventory of information and other associated assets, acceptable use rules and the rest. A good gap analysis has one line per requirement and three columns: what the standard asks, what evidence exists today and where, then the verdict — conforming, partial or absent, with an owner and a deadline. Percentages without owners close nothing.
A gap analysis fails quietly when the evidence exists only on paper. A signed policy means nothing if nobody follows it. Check the actual practice, not just the file in the folder. Ask people how they really work and compare the answer with the document. If the two don't match, the gap is bigger than the table says. A simple example: the rule says access is reviewed quarterly, but the last extract is two years old. The requirement is then partial, not compliant, no matter how well the policy is written. The next step: how to turn these findings into actions someone actually finishes.
A gap table only becomes useful when every line has an owner with real decision power. Not the person who knows the most about the topic, but the one who can allocate time and money. A risk assigned to someone without a budget stays on paper. The deadline must be a verifiable date, not urgent, not soon, not this quarter. And a partial status is more valuable than an optimistic conformant one: it says precisely what is missing. A concrete example: instead of access is reviewed, write that Ana from operations will deliver access extracts for all systems by a specific date, with a pool of hours approved by her manager. If the date passes without delivery, the gap has not vanished, it has only moved. Then the question changes: who checks that the deadline was met, and what happens when it was not.
Why it matters Stage 1 is most often failed not for lack of controls but for lack of the documented evidence the standard names outright.