Gap analysis and snapshots
Grading a control tells you where you are. Gap analysis tells you how far that is from where you need to be, and snapshots let you prove you moved.
Compliance → Assessments → (an engagement) → Gap analysis
Target profiles
A target profile is the maturity you require of each control — your standard, not the framework's. One profile can serve many engagements.
Link a profile to an engagement and every control gains a target beside its current grade. Controls with no target are reported separately rather than counted as failures: not having decided a target is not the same as missing it.
Edit Targets sets the target maturity and a priority from P1 to P5 for each control. There is a set-all shortcut for doing a whole framework quickly.
A control marked P1 must be done before the engagement can be completed. This is how you say "this one is not optional this cycle." Priorities below P1 are for reporting only.
What the numbers mean
Every figure on this page is measured against the target profile, over the controls it actually targets. That makes them different numbers from the ones on the engagement page and in the report, which measure the whole framework — and the difference is the point of the page.
| Figure | How it is calculated |
|---|---|
| Meeting target | The percentage of evaluated controls that are at or above their target. Evaluated means: in scope, graded, and carrying a target. |
| Avg current | Mean maturity of those same evaluated controls. |
| Avg gap | Mean distance from current to target across those same controls. |
The engagement page and the report show a compliance rate — compliant ÷ judged, over the whole framework. This page shows controls meeting their target ÷ evaluated, over the part of the framework the profile targets. On a profile that covers only some controls the two will legitimately differ, and neither is wrong. Likewise Avg current here is the average over targeted controls, while the report's average maturity covers every graded control in scope.
Snapshots
A snapshot freezes today's gap position: the overall figures, per-domain rollups, and which profile they were measured against.
Take one manually with Snapshot, and the platform takes one automatically the moment an engagement is completed — that is the record of what the engagement concluded, and it survives a later reopen.
Snapshots are taken while an engagement is open. A completed or cancelled engagement keeps the snapshot it closed with and refuses new ones — a later snapshot against a profile someone has since edited would file a second, different "closing" number.
Select two snapshots on the timeline and Compare to see the movement between them: compliance, gap score, average maturity and controls meeting target, each as a delta.
Compare only works between two snapshots measured against the same target profile, and both must have had a profile linked when they were taken. A delta between two different targets — or between a measured snapshot and one with nothing to measure against — is not movement, and the platform says so instead of printing one.
A target profile that any snapshot was measured against cannot be deleted; the snapshot's provenance depends on it. Retire it by unlinking it from engagements instead.
If no target profile is linked, a snapshot records that fact rather than reporting zero. A blank engagement is not a non-compliant one.