Explainer · 4 min read

Risk assessment vs. gap assessment: which do you need?

Both are common first steps, and they answer different questions. A risk assessment asks “what could hurt us most, and what should we fix first?” A gap assessment asks “how do we measure up against a specific standard?” Here’s how to choose.

Risk assessment: start here if no one has named a standard

A risk assessment looks across your people, data, systems, and vendors to find the threats most likely to cause real harm, then ranks fixes by impact, effort, and cost.

• Best when: you don’t know where to start, you have a limited budget, or a board or funder asked how you manage risk.
• You get: a prioritized action plan, quick wins, a risk register you can maintain, and a plain-language summary for leadership.
• Method: usually NIST SP 800-30 for rating risk, scaled to a small organization.

Gap assessment: start here if someone expects a framework

A gap assessment compares what you do today, control by control, against a named standard: SOC 2, NIST CSF 2.0, CIS Controls, ISO 27001, HIPAA, or GDPR. It shows what’s in place, what’s partial, and what’s missing.

• Best when: a funder, partner, customer, insurer, or regulator has named a framework, or you’re preparing for an audit.
• You get: a control-by-control gap report, maturity scores, a remediation roadmap, and an honest view of audit readiness.
• Note: a gap assessment is not an audit. Formal audits, like a SOC 2 report, are performed by independent firms. A gap assessment tells you whether you’re ready before you pay for one.

How to choose

• Has anyone asked for a specific framework? If yes, start with a gap assessment against that framework.
• No one has named a standard, and you want to know where to spend first? Start with a risk assessment.
• You handle health information? HIPAA requires a security risk analysis, so a risk assessment is usually the right first step, followed by a HIPAA gap assessment.
• Small organization, no requirements yet? A risk assessment, or a gap assessment against CIS Controls IG1, the most practical baseline for small teams.

Can you do both?

Yes, and they complement each other. A risk assessment tells you what matters most for your organization, and a gap assessment proves you meet an external bar. Many organizations do a risk assessment first, then a gap assessment when a funder or partner asks for a framework. Many controls overlap, so the second one goes faster.

Next step

See the Risk Assessment and Framework Gap Assessment pages for scope and fixed prices. Not sure which fits? Book a free 30-minute intro call and I’ll recommend one, even if the answer is neither.