A structured evaluation process used to compare an organization’s current cybersecurity practices against required standards such as NIST SP 800-171 or the CMMC framework. The goal is to identify gaps—areas where controls are missing, incomplete, or not effectively implemented—that must be addressed before an organization can achieve compliance.

A gap analysis typically involves reviewing policies, technical safeguards, and operational processes, then mapping them against regulatory requirements. The findings are documented in a report that highlights deficiencies, prioritizes risks, and recommends remediation steps. Organizations often use the results to update their System Security Plan (SSP) and develop a Plan of Action & Milestones (POA&M).

Conducting a gap analysis early provides a clear roadmap for achieving compliance and helps contractors avoid costly delays or failed assessments during a formal CMMC certification review.