Gap Analysis

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 50

Learners work out what they need to know before training for a 10 km run, and whether to ask or check, before current and target states are named. Predictions then precede the order of the four steps, how to combine area scores, what a 75% hides, whether the lowest score comes first and what each gap needs; checks follow comparison against attack, Protect’s score, Gap A and Profiles. The habit to build: read a score for what it measures, then prioritise by risk.

Objectives

• Define current state, target state, gap and remediation
• Follow the four steps of a gap analysis, and why it repeats
• Calculate area and group scores correctly
• Explain what a score does not tell you
• Prioritise gaps by risk and turn them into a remediation plan

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Risk and NIST Cybersecurity Framework lessons first.
• Calculators help for the scoring step.
• The lesson takes about 50 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Define current state, target state, gap and remediation
   • Follow the four steps of a gap analysis, and why it repeats
   • Calculate area and group scores correctly
   • Explain what a score does not tell you
   • Prioritise gaps by risk and turn them into a remediation plan

   Purpose: Learners work out what they need to know before training for a 10 km run, and whether to ask or check, before current and target states are named. Predictions then precede the order of the four steps, how to combine area scores, what a 75% hides, whether the lowest score comes first and what each gap needs; checks follow comparison against attack, Protect’s score, Gap A and Profiles. The habit to build: read a score for what it measures, then prioritise by risk.

2. 1. Ten kilometres by summer Think 5 min

   Purpose: Derive current and target states from a personal goal.

   Ask

   • What two things do you need to know?
   • Ask or check?

   Responses to expect

   • Both come quickly.
   • On screen in turns: the opening question, its answer; then the question on asking or checking, and its answer.

   Discussion pause: Ask one learner to describe their own “where I am now” honestly.

   In the lesson window

   • Think it through: You want to be able to run 10 km by the summer. Before planning any training, what two things do you need to know?
   • Think it through: Should you find out where you are now by asking yourself, or by checking?

3. 2. The idea Explain 4 min

   Purpose: Define current state, target state, gap and remediation, and that it is a comparison.

   Ask

   • Does a gap analysis attack anything?

   Responses to expect

   • No: it is a comparison only.
   • On screen in turns: the opening; then four terms, starting with the current state; the target state; the gap; remediation; putting it together; the check question on whether a gap analysis attacks, and its answer; a comparison, not an attack.

   Misconceptions to challenge

   • A learner may believe: “A gap analysis is a security test.” Respond: It is a comparison against a target.

   In the lesson window

   • Check your understanding: Does a gap analysis try to break into systems?

4. 3. Four steps Predict 4 min

   Purpose: Order the four steps and show why the cycle repeats.

   Ask

   • What is the right order?

   Responses to expect

   • Some start by listing gaps.
   • On screen in turns: the opening question, its answer; then the gap-analysis cycle, one step at a time; assess the current state; identify the gaps; plan the remediation; why the work repeats.

   In the lesson window

   • Think it through: Put these in order: plan the remediation, identify the gaps, define the target, assess the current state.

5. 4. A worked example: scoring against a framework Predict 8 min

   Purpose: Read the example scores and calculate them correctly.

   Ask

   • How do you combine Identify’s areas?
   • What is Protect’s score?

   Responses to expect

   • Averaging percentages is the usual error.
   • On screen in turns: the opening; then the example’s scores, starting with Identify; Protect; the same figures as a table, with the scores held back; the scores; the question on Identify’s overall score, and its answer; how each percentage is calculated; a Function’s score is a sum; the check question on Protect’s overall score, and its answer; what the scores are for.

   Misconceptions to challenge

   • A learner may believe: “A Function’s score is the average of its areas’ percentages.” Respond: Sum the achieved figures and the totals first.

   Discussion pause: The scores column is held back: let the class work out each percentage, and Identify’s overall score, before revealing it.

   If the explanation does not land: Use two classes of different sizes: averaging their pass rates misstates the year’s rate.

   In the lesson window

   • Think it through: Identify has three areas: 4 of 6, 3 of 4 and 3 of 6. How would you work out Identify’s overall score?
   • Check your understanding: Protect has areas of 5 of 8 and 3 of 8. What is its overall score?

6. 5. Reading the scores Predict 4 min

   Purpose: List what a score does not tell you.

   Ask

   • What can 75% not tell you?

   Responses to expect

   • Weighting is the point most often missed.
   • On screen in turns: the opening question, its answer; then what a score does not tell you, starting with what is missing; how much the area matters; how good the evidence was; how points were defined.

   In the lesson window

   • Think it through: An area scores 75%. List what that number cannot tell you.

7. 6. Prioritise by risk, not by percentage Predict 8 min

   Purpose: Prioritise by risk, with the two fictional gaps.

   Ask

   • Must the lowest score be fixed first?
   • Why does Gap A come first?

   Responses to expect

   • Most expect lowest-first.
   • On screen in turns: the opening; then the question on fixing the lowest score first, and its answer; the lowest is not automatically the most urgent; two gaps, two priorities, starting with Gap A; Gap B; comparing them by risk; not stopping there; the check question on why Gap A comes first, and its answer; four questions for every gap, starting with impact; criticality; likelihood; context; where likelihood and impact are taught.

   Misconceptions to challenge

   • A learner may believe: “The lowest score is the biggest problem.” Respond: Impact, criticality, likelihood and context set the priority.

   To go further

   • What evidence would you want before agreeing that Gap B is low priority?

   In the lesson window

   • Think it through: Data Security scored lowest. Must it be fixed first?
   • Check your understanding: In the example, why does Gap A come before Gap B?

8. 7. From gaps to a remediation plan Predict 4 min

   Purpose: Turn gaps into actions with owners, dates and checks, or recorded acceptance.

   Ask

   • What does each gap need?

   Responses to expect

   • Owners and checks are often missed.
   • On screen in turns: the opening question, its answer; then what the plan records, starting with the action; an owner; a date; how completion is checked; accepting a gap deliberately.

   Misconceptions to challenge

   • A learner may believe: “Once the gaps are listed, the job is done.” Respond: The value is in the plan that follows.

   In the lesson window

   • Think it through: You have a list of twelve gaps. What does each one need before anything gets fixed?

9. 8. Gap analysis and the NIST framework Explain 3 min

   Purpose: Name NIST’s Current and Target Profiles, and other possible targets.

   Ask

   • What does NIST compare?

   Responses to expect

   • Two Profiles.
   • On screen in turns: the opening; then the check question on NIST Profiles, and its answer; gap analysis is not tied to NIST; two questions before priorities.

   In the lesson window

   • Check your understanding: In NIST’s terms, what is compared in a gap assessment?

10. 9. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • 100% tests compliance against security; 63.9% tests calculation; the costly gap tests acceptance.
    • On screen in turns: the opening; then the question on scoring 100%, and its answer; the question on an averaged score, and its answer; the question on a gap that costs more than its harm, and its answer.

    In the lesson window

    • Apply it: A department scores 100% against Cyber Essentials. Does that mean it is secure?
    • Apply it: A colleague reports Identify as 63.9% by averaging the three area percentages. What do you say?
    • Apply it: One gap would cost far more to close than the harm it could cause. What can the organisation do?

11. 10. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The scoring question links to the worked example.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

12. 11. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the four steps.

    Responses to expect

    • Define the target, assess the current state, identify the gaps, plan the remediation.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Where we are, against where we should be.
    • Four steps, repeated.
    • Totals first, percentages last.
    • A score is not a priority.
    • Every gap needs an owner, a date and a check.

Consolidation

• Where we are, against where we should be.
• Four steps, repeated.
• Totals first, percentages last.
• A score is not a priority.
• Every gap needs an owner, a date and a check.