After adopting a control framework, the information security manager wants to know where the controls actually in place fall short of the control objectives that management has set. Which technique BEST meets this need?
Select an answer to reveal the explanation.
Short Explanation
A gap analysis is like holding the packing list up against the suitcase: what should be there versus what actually is. That's exactly the question here. The trap is picking a tool that answers something else, like how bad an outage would be or how you stack up against the neighbors.
Full Explanation
A control gap analysis compares a defined desired state, here the control objectives management has set, with the current state of implemented controls, identifying missing, partial or ineffective controls and the risk each gap leaves. Its output is a prioritized list of gaps that feeds the security program roadmap and risk treatment decisions. A business impact analysis identifies critical processes and the consequences of their disruption; it informs which objectives matter most but does not compare objectives with implemented controls. A penetration test examines whether specific technical weaknesses can be exploited; it can expose some control failures but cannot systematically assess coverage of all objectives, including administrative and procedural ones. A peer maturity benchmark measures the organization against other companies, which may be informative, but those peers' controls are not management's stated objectives and the comparison does not reveal where this organization's controls fall short of its own requirements. Exam caveat: the objectives themselves must derive from business requirements and risk appetite, or the gap analysis measures the wrong target. Operational check: confirm each control objective has a mapped control, a current status, a gap rating and, where a gap exists, an owner and treatment plan.