After a gap analysis, the water utility lists missing MFA on VPN as a control gap versus policy. What does that gap analysis primarily represent?

Gap analysis assesses differences between the current security state and a target state defined by policy, standards, frameworks, or desired controls. When a water utility lists missing MFA on VPN as a control gap versus policy, the gap analysis primarily represents that comparison: present posture versus required or desired controls. The finding informs prioritization; it is not itself exploitation, an exercise script, or a permanent substitute control.

Equating gap analysis with a penetration test that actively exploited the VPN concentrator confuses assessment-of-coverage with offensive validation. Pen tests may later verify exploitability of gaps, but the gap list is a comparative analysis. Equating it with a tabletop that role-played ransomware confuses control-gap documentation with discussion-based incident exercises. Calling the gap analysis a compensating control that replaces MFA permanently misstates both terms: compensating controls are alternate mitigations deployed when a preferred control is not yet feasible; gap analysis identifies the shortfall and does not permanently waive MFA by existing as a document.

Exam caveat: SY0-701 places gap analysis under fundamental security concepts. Know it as current-versus-desired comparison, often feeding risk registers and roadmaps for municipal utilities and IT.

Operational check: after gap analysis, assign owners and dates for VPN MFA (or documented compensating controls with residual risk), track closure in the risk committee, and re-test. Do not file the gap report as if listing a missing control somehow secured the water utility's remote access.