An analysis that measures the difference between the current and desired states to help assess the scope of work in a project.

An analysis that measures the difference between the current and desired states to help assess the scope of work in a project.

• A. CSF
• B. Security controls
• C. IAM
• D. Gap analysis

Answer: (D)

Gap analysis is the process of comparing the current state with the desired state to identify what needs to be done to reach the target. In project planning, this helps define the scope by outlining the gaps between where you are now and where you want to be, so you can plan the tasks, resources, and timeline required to close those gaps. For example, in a security project, you might assess current access controls and compliance requirements, define the target state (such as MFA and updated policies), and the gap analysis reveals the specific work needed—implement MFA, adjust permissions, update policies, train users, and set up auditing—so you can prioritize and estimate effort and cost. The other concepts are different: a cybersecurity framework provides guidelines to manage risk, not the diagnostic process; security controls are the measures you implement; IAM is the domain focusing on identities and access management, not the analysis of gaps.

Gap analysis is the process of comparing the current state with the desired state to identify what needs to be done to reach the target. In project planning, this helps define the scope by outlining the gaps between where you are now and where you want to be, so you can plan the tasks, resources, and timeline required to close those gaps. For example, in a security project, you might assess current access controls and compliance requirements, define the target state (such as MFA and updated policies), and the gap analysis reveals the specific work needed—implement MFA, adjust permissions, update policies, train users, and set up auditing—so you can prioritize and estimate effort and cost. The other concepts are different: a cybersecurity framework provides guidelines to manage risk, not the diagnostic process; security controls are the measures you implement; IAM is the domain focusing on identities and access management, not the analysis of gaps.