Control mapping and gap analysis
Connect requirements to implemented measures and make gaps explicit.
The idea
Control mapping links requirements or outcomes to organizational safeguards and evidence. One control may support several requirements, but the relationships need explanation. Gap analysis compares the current state with the required or desired state. Separate missing design, incomplete deployment, and ineffective operation because they require different fixes. Assign owners and prioritize gaps by risk and obligation rather than counting mapped cells.
In practice
A requirement for timely access removal is mapped to the leaver process, account-disable records, token handling, and review evidence.
A common misunderstanding
Mapping a requirement to a policy title is not proof that the requirement is satisfied.
Check your understanding
What should a useful gap record include?
Think it through: Expected outcome, observed state, evidence, consequence, owner, and planned correction.
A similar label is not an equivalent control
Control mapping connects a requirement or desired outcome with the measures intended to satisfy it. Start by understanding the requirement's purpose and scope. Two frameworks may both mention access management while expecting different evidence or coverage. A shared keyword is a useful starting point for analysis, not proof of equivalence.
For each mapped measure, identify its implementation owner and how operation is demonstrated. A gap may concern missing design, incomplete deployment, weak operation, or insufficient evidence. These are different problems. Installing a tool addresses neither an undefined process nor a control that exists only on a subset of the relevant systems.
A fictional access mapping
An academy maps a requirement for timely removal of access to an automated identity workflow. Review reveals that several external applications are not connected to that workflow. The mapping is partly valid, but the scope gap needs an explicit treatment such as manual offboarding verification or integration work. Marking the requirement fully covered would hide the remaining exposure.
Mappings should remain reviewable as systems and standards change. Keep the source requirement, interpretation, mapped measure, evidence, and exceptions connected. A matrix copied from another organization may usefully suggest questions, but its conclusions need validation against the actual environment.
Find a mapping gap
Take a fictional requirement that privileged access be approved and periodically reviewed. Map it to an approval form and a scheduled review process. Explain which part each supports, who performs it, and what evidence demonstrates operation. Then imagine service accounts are excluded from the review. State whether that exclusion is justified, unresolved, or outside the requirement's scope rather than silently ignoring it.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Cybersecurity Framework 2.0 FAQs