GRC › Module 8 › Lesson 1
Gap Analysis
Gap analysis literacy — control requirement, current state, gap description, risk rating stub, remediation priority — named gap rows on YOUR `$GRC_LAB` audit findings.
Visual · t37_gap_analysis
Gap analysis = named finding rows. $GRC_LAB. Original Cyberlium.
Opening
Gaps between required and actual state drive remediation — name gap rows on YOUR lab findings before hiding gaps or forging pass results for certification fraud.
Gap analysis literacy names: control requirement row category, current state assessment category, gap description category, risk rating stub category, and remediation priority category. Analyst documents gap register on `$GRC_LAB` — three gaps from Module 7 audit summary with honest current state — without hiding gaps from reports, without marking all controls pass without evidence, without forging gap closure for external audit fraud. Cyberlium teaches gap vocabulary on YOUR notes labeled LAB. Refused: hidden gaps, forged pass results, fake remediation closure. Lab row: gap register (three gaps, requirement, current state, priority, LAB label).
1. Named gap rows
Requirement, current state, gap description, risk rating, priority — five literacy anchors.
Each gap links Module 7 audit exception — same org thread.
Command guide
Try these commands — Named gap rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST CSF — https://www.nist.gov/cyberframework ISO 27001 gap — https://www.iso.org/isoiec-27001-information-security.html CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
export GRC_GAP=${GRC_GAP:-$GRC_LAB/LAB-ORG-001/gap}
cat > "$GRC_LAB/notes/gap-analysis-named.txt" <<'EOF'
Gap analysis — NAMED LITERACY:
Current state: what controls exist + evidence maturity
Target state: framework profile or certification requirements
Gap: missing control, weak evidence, or inconsistent implementation
Prioritize: risk, regulatory, customer contract deadlines
Output: gap register with owner, remediation, target date
Lab: gap-analysis-stub.csv — fictional LAB-ORG-001 rows
EOFCommand — copy this
grep -E 'Current state|Gap|gap register' "$GRC_LAB/notes/gap-analysis-named.txt"
python3 -c "print('Gap analysis: current vs target — prioritize remediation')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST CSF (https://www.nist.gov/cyberframework); ISO 27001 gap (https://www.iso.org/isoiec-27001-information-security.html); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Honest current state
Current state cites LAB evidence or honest partial — not assumed pass.
Risk rating stub documented before priority — not inflated for drama or minimized for fraud.
3. Refused
No hidden gaps; no forged pass without evidence; no fake closure dates.
Gap literacy supports remediation — not compliance theater.
4. What you ship: gap register
Three gaps + requirement + current state + priority + NEVER hidden gap line.
5. What you record before the next lesson
Gap register path.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark all `$GRC_LAB` controls pass without evidence to forge clean gap report for certification fraud.
Right
Gap register from `$GRC_LAB` audit findings. Next: Evidence Hygiene.
Mission: gap register
1) Name five gap analysis literacy rows. 2) Three gaps from Module 7 audit. 3) Honest current state and priority each. 4) Write NEVER hidden gap line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Risk rating vs priority — literacy split?”
Knowledge Check
APPLY: Gap analysis literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Hiding gaps from audit reports is acceptable.
True or False
Knowledge Check
APPLY: Gap register includes:
Multiple choice