Which practice evaluates the current security posture by identifying gaps between desired and actual controls?

Which practice evaluates the current security posture by identifying gaps between desired and actual controls?

• A. Insider Risk Controls
• B. Gap Analysis
• C. Phish Tank
• D. Deterrence Controls

Answer: (B)

Evaluating security posture by comparing what you want to have in place with what actually exists is Gap Analysis. It starts by defining the target set of security controls or standards you aim to meet, then auditing the current environment to see which controls are implemented, how effectively they work, and where they fall short. The outcome is a prioritized list of gaps, often with risk implications and a plan to close them, enabling you to focus remediation where it will have the most impact. For example, if the goal is multi-factor authentication everywhere but certain systems still rely on passwords, those gaps are identified and prioritized for action. This approach differs from insider risk controls, which focus on detecting and mitigating threats from users within the organization; Phish Tank relates to phishing awareness training and simulations; and deterrence controls are measures meant to deter attackers rather than measure and close gaps in the current control framework.

Evaluating security posture by comparing what you want to have in place with what actually exists is Gap Analysis. It starts by defining the target set of security controls or standards you aim to meet, then auditing the current environment to see which controls are implemented, how effectively they work, and where they fall short. The outcome is a prioritized list of gaps, often with risk implications and a plan to close them, enabling you to focus remediation where it will have the most impact. For example, if the goal is multi-factor authentication everywhere but certain systems still rely on passwords, those gaps are identified and prioritized for action. This approach differs from insider risk controls, which focus on detecting and mitigating threats from users within the organization; Phish Tank relates to phishing awareness training and simulations; and deterrence controls are measures meant to deter attackers rather than measure and close gaps in the current control framework.