Security incident? Get help now →

Framework Gap Assessment

See exactly how you measure up.

A control-by-control comparison against the framework your funders, partners, or regulators expect, with a clear path to close the gaps.

Book a free intro call

A good fit if you:

  • Were asked for SOC 2 or ISO 27001 by a partner or customer
  • Handle health information or EU personal data
  • Saw NIST or CIS named by a funder or insurer
  • Are planning an audit in the next year

Frameworks I assess against

Not sure which applies to you? That’s one of the first things we’ll sort out.

CIS Controls IG1

A practical security baseline built for small organizations. Often the best place to start.

NIST CSF 2.0

Widely recognized and flexible. A common choice when funders or boards ask for a standard.

SOC 2

For organizations that store or process data on behalf of partners or customers.

ISO 27001

The international standard, often expected by global partners.

HIPAA Security Rule

For organizations that handle protected health information.

GDPR

For organizations with supporters, clients, or staff in the EU or UK.

What you get

Control-by-control gap report

What’s in place, what’s partial, and what’s missing, with the evidence behind each finding.

Maturity scores

A clear baseline you can measure progress against over time.

Remediation roadmap

The gaps in a sensible order, with effort and timeline for each.

Audit-readiness estimate

An honest view of how far you are from a successful audit.

Policy inventory

Which required policies you have, which need updating, and which are missing.

Readout session

We walk through the results with your team and leadership.

Fixed price from $4,500, with 20% off for qualifying nonprofits. See pricing →

How it works

Usually three to six weeks, depending on the framework and your size.

  1. Step 1

    Scope

    We confirm the framework, the systems in scope, and who I’ll talk to.

  2. Step 2

    Review

    I review your policies, settings, and evidence, and interview key staff.

  3. Step 3

    Score

    Each control is rated against the framework’s requirements.

  4. Step 4

    Report & readout

    You get the report and roadmap, and we review them together.

Common questions

Is this the same as an audit?

No. Formal audits are done by independent firms, such as a CPA firm for SOC 2 or a certification body for ISO 27001. A gap assessment tells you whether you’re ready, before you pay for one.

Which framework should we choose?

If someone has asked for a specific one, start there. If not, CIS Controls IG1 or NIST CSF 2.0 are usually the right fit for small organizations.

Can you assess more than one framework?

Yes. Many controls overlap, so I map them together to avoid doing the same work twice.

Related services

Compliance Readiness Risk Assessment Virtual CISO

Know where you stand before the auditor does.

A free 30-minute call to pick the right framework and scope.

Book a free intro call