Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Control Deficiencies and Security Gap Analysis
Three kinds of deficiency
| Deficiency | Meaning | Example |
|---|---|---|
| Missing control | No control exists for a known risk | No MFA on remote access |
| Design deficiency | The control exists but couldn’t achieve its objective even if run perfectly | The access review excludes administrator accounts |
| Operating deficiency | A well-designed control isn’t performed as intended | Reviews skipped for two quarters |
The 2026 CISM outline names this “vulnerability and control deficiency analysis”: vulnerabilities and weak controls are two sides of the same picture.
Where the evidence comes from
- Audits: internal and external findings.
- Assessments and tests: risk and maturity assessments, vulnerability scans, penetration tests.
- Incidents: every incident shows where a control failed or was missing.
- Metrics: KPIs and KRIs drifting out of range.
- Regulators and customers: inspection findings, security questionnaires.
Gap analysis
- Choose the benchmark: the organisation’s policy, a framework (ISO 27001, NIST CSF), a regulation, or the target state in the strategy.
- Gather evidence of the current state.
- Identify gaps: missing, badly designed or not operating.
- Find root causes.
- Prioritise and plan by risk, with owners, dates and budgets.
Gap analysis against a framework complements risk assessment but doesn’t replace it. Not every framework gap is a significant risk for the organisation.
Find the root cause
Example. Audit finds 30 leavers with active accounts. IT disables them, but next year there are 25 more. The root cause: HR leaver notices go by email to whoever is on duty. The lasting fix is an automatic feed from HR to the identity system, with a named owner.
Common root causes include unclear ownership, missing skills, insufficient resources, manual processes and controls that don’t fit how people work.
Prioritise and track
- Rate each gap by the risk it leaves.
- Group related gaps into initiatives.
- Assign owners, dates and budgets.
- Report progress and overdue items to the steering committee.
- Verify fixes before closing them.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| A control exists but can’t meet its objective | Design deficiency |
| A good control isn’t performed as intended | Operating deficiency |
| The same finding repeats every year | Address the root cause |
| How to prioritise gaps | By the risk they leave |
| Benchmark for a gap analysis | Policy, framework, regulation or target state |
In short
- A control deficiency is a missing control, a design deficiency (can't achieve its objective) or an operating deficiency (not run as designed).
- Evidence of deficiencies comes from audits, assessments, tests, incidents, metrics and regulator findings.
- Gap analysis compares the current state with a benchmark: policy, framework, regulation or target state.
- Gaps are prioritised by the risk they leave, not by how easy they are to fix.
- Find the root cause (ownership, skills, resources, process) so the gap doesn't return.
- Remediation plans have owners, deadlines and budgets, and are tracked to closure.
Exam traps
- Fixing only the symptom (one missed review) without the cause (no owner) means the gap reappears.
- A control that exists on paper but doesn't operate is a deficiency.
- Prioritise by risk, not by the number of gaps closed.
- Gap analysis against a framework doesn't replace risk assessment; not every framework gap is a significant risk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Three kinds of deficiency
Gap analysis
1 / 9