Skip to main content
Cyber Risk Council
Category: Risk Management

Control Gap

Also known as: Controls Gap
Simply put

A control gap is a weakness or missing piece in an organization's set of security or compliance safeguards, where the controls in place do not fully address a particular risk. It can occur when a needed control does not exist at all, or when an existing control fails to work effectively. Identifying and closing these gaps is a core part of managing risk, though the significance of any given gap depends on the risk it leaves exposed.

Formal definition

A control gap is a condition in which an organization's internal control environment fails to fully address a financial, operational, or compliance risk. Per common practitioner usage, a control gap arises when a control does not exist, does not effectively mitigate the associated risk, or is not operating effectively in practice. Note that some sources use 'controls gap' in a distinct quantitative sense, the amount of risk reduced by implementing safeguards, so the intended meaning may vary by context; typically the term denotes an absent or deficient control rather than a measure of risk reduction. In a virtual CISO engagement, identifying control gaps informs risk treatment and remediation planning, but accountability for accepting, remediating, or transferring the underlying risk generally remains with the client organization.

Why it matters

Control gaps represent the practical difference between the security posture an organization believes it has and the one it actually operates. When a needed safeguard is missing entirely, works only on paper, or fails to operate effectively in day-to-day practice, a risk that leadership assumes is covered may in fact be exposed. Because the significance of any given gap depends on the risk it leaves open, treating all gaps as equally urgent, or dismissing them without assessing the underlying risk, can misdirect limited security resources.

For security leaders, control gaps are the connective tissue between risk assessment and remediation planning. A gap that is identified but not understood in the context of the risk it leaves unaddressed offers little value; conversely, a well-characterized gap allows an organization to make a deliberate decision to remediate, accept, or transfer the associated risk. This distinction matters because identifying a control gap is a governance and risk activity, not merely a technical finding, and the decision about what to do with the exposed risk is a business decision.

It is worth noting that the term itself carries some ambiguity. Most practitioner sources describe a control gap as an absent or deficient control, but some sources, notably certain certification study materials, use 'controls gap' in a quantitative sense to mean the amount of risk reduced by implementing safeguards. Because these two meanings differ, security leaders should confirm which sense is intended in a given document, assessment, or conversation to avoid miscommunication.

Who it's relevant to

Security and risk leaders
CISOs, virtual CISOs, and fractional security leaders use control gap identification to inform risk treatment decisions. For them, the value lies not in cataloging gaps but in characterizing the risk each gap leaves exposed so the organization can decide whether to remediate, accept, or transfer it. They should be clear that surfacing a gap is a governance activity and that accountability for the resulting risk decision remains with the client organization.
Compliance and audit stakeholders
Those responsible for compliance and internal audit rely on control gap analysis to determine where existing controls do not fully address a compliance risk. They should distinguish between a gap that reflects an absent or deficient control and the quantitative sense of 'controls gap' used in some study materials, since conflating the two can distort findings and remediation priorities.
Executives and organizational officers
Business leaders carry the ultimate accountability for accepting, remediating, or transferring the risks that control gaps leave exposed. They benefit from understanding that a control gap is a business risk matter, not solely a technical finding, and that the significance of any gap depends on the underlying risk rather than the mere existence of a missing or deficient control.
Consultants delivering gap assessments
Advisory and consulting practitioners performing gap assessments depend on organizational maturity, stakeholder cooperation, and defined scope to surface gaps accurately. They should recognize that gaps never brought to light cannot be treated, and that their role is to inform remediation planning rather than to assume the client's accountability for the exposed risk.

Inside Control Gap

Current State
The set of security controls, processes, and safeguards an organization actually has in place at the time of assessment, including their configuration, coverage, and operational effectiveness.
Target State
The desired or required level of controls defined by a chosen framework, regulation, contractual obligation, or internal risk tolerance, such as NIST CSF profiles, ISO 27001 requirements, or SOC 2 criteria.
The Gap
The measurable difference between current and target states, expressed as missing controls, partially implemented controls, or controls that exist but do not operate effectively.
Reference Framework or Requirement
The benchmark against which the gap is measured. The gap is only meaningful relative to a stated target, so the framework or obligation used should always be explicitly identified.
Risk Context
The business and threat context that determines how significant a given gap is. Not all gaps carry equal weight; severity typically depends on the assets, data, and exposure involved.
Remediation Path
The prioritized set of actions, owners, and timelines needed to close or reduce the gap, often captured in a roadmap or plan of action and milestones.

Common questions

Answers to the questions practitioners most commonly ask about Control Gap.

Does a control gap mean the organization has been breached or is actively under attack?
No. A control gap identifies a difference between the controls an organization expects or intends to have and those actually in place and operating effectively. It reflects a weakness or absence that could increase risk, but it is not evidence of a compromise. An organization can carry known control gaps for extended periods without an incident occurring, just as a breach can happen in areas where controls were believed adequate. Treating a control gap as equivalent to an active breach conflates a risk condition with a security event.
Will a virtual CISO close our control gaps directly?
Typically not through hands-on execution. A virtual CISO usually identifies control gaps, prioritizes them by risk, and directs a remediation plan, but the operational work of implementing controls, configuring tools, or administering systems generally falls to internal staff, existing service providers, or others explicitly contracted for that work. The vCISO advises and guides; accountability for acting on the guidance and for the resulting security decisions usually remains with the client organization. Where hands-on remediation is expected, it should be defined in the engagement scope rather than assumed.
How do you decide which control gaps to address first?
Prioritization typically weighs the risk associated with each gap rather than tackling gaps in the order they were found. Common factors include the likelihood and potential impact of exploitation, the value or sensitivity of the affected assets, any relevant regulatory or contractual obligations, and the cost and effort of remediation relative to the risk reduction achieved. A virtual CISO often frames these decisions in business risk terms so that leadership can allocate limited resources deliberately. The specific ordering may vary by organization and its risk appetite.
What is needed to identify control gaps accurately in the first place?
Accurate gap identification generally depends on a defined reference point, such as a chosen framework or set of expected controls, and on visibility into how controls actually operate day to day. This usually requires access to stakeholders, documentation, system configurations, and process owners. The value of the assessment often depends on organizational maturity and client cooperation, since gaps that are hidden by incomplete information or limited access may go undetected. Assessing controls against an expectation, not simply cataloging what exists, is what distinguishes a gap analysis from an inventory.
How is a control gap different from a vulnerability found in a scan?
A control gap and a technical vulnerability operate at different levels. A vulnerability is typically a specific technical weakness in a system or application, often surfaced through scanning or testing. A control gap describes a missing or ineffective control at the process, governance, or program level, such as the absence of a patch management process. A pattern of recurring vulnerabilities may itself point to an underlying control gap. Conflating the two can lead teams to remediate individual technical findings while leaving the systemic weakness that produced them unaddressed.
Does closing a control gap mean we are compliant or certified against a framework?
Not necessarily. Closing identified control gaps can support readiness for a framework or standard such as NIST CSF, ISO 27001, SOC 2, HIPAA, PCI DSS, GDPR, or CMMC, but readiness is distinct from formal certification or attestation. Certification generally requires evaluation by an authorized assessor or auditor against defined criteria, and compliance status can depend on evidence, sustained operation of controls, and factors beyond the gaps a given assessment covered. A virtual CISO engagement can help prepare for that process without guaranteeing a compliance or certification outcome.

Common misconceptions

Closing all control gaps guarantees compliance or certification.
A gap assessment typically supports readiness by identifying where controls fall short of a target framework, but closing gaps does not by itself confer certification. Formal certification for standards such as ISO 27001 or an attestation such as SOC 2 requires independent audit or assessment beyond the scope of most virtual CISO engagements.
A control gap is purely a technical shortfall that tooling can resolve.
Many gaps are governance, process, or documentation deficiencies rather than missing technology. Security leadership treats gaps as business risk and governance issues, and remediation often depends on policy, ownership, and organizational maturity rather than a new tool.
A virtual CISO who identifies gaps also becomes accountable for closing them.
A virtual CISO typically advises on and prioritizes remediation and may direct the effort, but legal and organizational accountability for security decisions and outcomes usually remains with the client organization and its officers. Execution of remediation depends on client cooperation and resources, and hands-on operational work is generally out of scope unless explicitly contracted.

Best practices

Always define the target state explicitly by naming the framework, regulation, or contractual requirement being measured against, since a gap has no meaning without a stated benchmark.
Prioritize identified gaps by risk context rather than treating every gap as equally urgent, focusing first on those affecting critical assets, sensitive data, or key exposures.
Distinguish between missing controls, partially implemented controls, and controls that exist but operate ineffectively, because each calls for a different remediation approach.
Capture remediation in a prioritized roadmap with named owners and realistic timelines, and confirm that accountability for decisions and execution rests with the appropriate client stakeholders.
Set expectations that gap closure supports readiness rather than guarantees certification, and clarify where independent audit or assessment is still required.
Revisit the gap assessment periodically, since current and target states shift as the organization matures, requirements evolve, and prior remediation is validated.