A company plans to adopt an industry security framework next year. It first wants to compare its current controls with the framework's requirements to find what is missing and plan remediation. No certification or external opinion is needed yet. Which engagement type fits?

A gap analysis compares the current state of an organization's controls, processes, and documentation against a target state, such as a framework, standard, or regulation, to identify where requirements are not yet met. The output is a list of gaps prioritized for remediation, which is exactly what an organization needs before adopting a framework. Because no certification or external opinion is required, the analysis can be performed internally or with consultants, at lower cost and with more candor than a formal assessment. An independent third-party audit provides an objective opinion on whether controls meet a standard, often leading to certification or a report for customers; it is premature when the organization knows it is not yet aligned and only needs to plan. A regulatory examination is conducted by a regulator with authority over the organization to assess compliance with legal obligations; it is not something an organization schedules to prepare for a voluntary framework. A penetration test simulates attacks to find exploitable weaknesses in specific systems; it can reveal technical gaps but does not compare the full set of controls with a framework's requirements. Exam caveat: a gap analysis is often repeated after remediation to confirm readiness before an external assessment. Operational check: confirm each framework requirement is marked met, partially met, or not met, with an owner and target date for every gap.