Fit Gap Analysis

What Fit Gap Analysis Measures

Fit gap analysis compares what an organisation needs against the capabilities, skills, controls, or operating model it already has. In practice, it turns a vague readiness question into a structured comparison, so leaders can see where delivery is already covered, where gaps exist, and what must be added before work begins.

Although the term is often used in programme planning, the underlying idea is broader: a fit gap review helps separate assumptions from reality. That makes it useful when a security initiative depends on people, process, and governance as much as technology.

Why Fit Gap Analysis Matters in Security Programmes

In security work, gaps are rarely only technical. A team may have the tooling but not the skills to operate it, or the policy intent but not the governance process to sustain it. Fit gap analysis exposes those mismatches early, before they become implementation delays, weak ownership, or an overreliance on outside support.

It is especially useful when a programme changes how work is done, because the review forces a decision about whether the gap will be closed by training, role redesign, process change, or specialist support. For a planning lens that turns gaps into sequencing and roadmap decisions, see Security Strategy and Roadmap Guide.

What a Fit Gap Review Typically Compares

A solid fit gap review usually compares the target operating need against the current state across several dimensions. That can include technical capability, such as whether the platform supports the required workflow; operational capability, such as whether the team can run it day to day; and governance capability, such as whether accountability, approvals, and exception handling are defined.

In identity governance programmes, the comparison often becomes more specific: can the organisation provision, review, approve, and revoke access at the pace and assurance level the programme requires? A practical template for that kind of current-versus-target comparison is the CSF 2.0 Organisational Profiles Template, which helps structure gap analysis and action planning.

The value of the method is not the list of gaps by itself. The real output is a clearer view of which gaps are blocking delivery, which are tolerable for now, and which require a formal decision because they affect risk or control design.

How Organisations Use the Findings

Once the gaps are known, organisations use the findings to choose between three broad responses: develop the capability internally, reshape the operating model, or source the missing capability externally. That decision is often as important as the analysis itself, because it determines ownership, cost, and how much institutional knowledge stays in-house.

Good fit gap analysis also prevents teams from confusing a tool purchase with readiness. If the skills, process discipline, and governance guardrails are not present, the new capability may remain underused or misconfigured. That is why workforce and skills planning often sits alongside fit gap work in security programmes, as reflected in Security Workforce Planning Guide.

For programmes that touch policy enforcement and access design, the same logic can apply to control maturity: a gap may be less about technology availability than about whether the team can test, tune, and operate the policy safely. Where conditional access is part of the target state, Conditional Access Guide shows how policy design and gap analysis fit together.

Risk and Threat Considerations

Fit gap analysis reduces implementation risk, but only if it is honest about missing capability. When organisations underestimate the gap, they can launch with weak operating ownership, incomplete governance, or controls that exist on paper but are not supportable in practice.

Failure mechanism: The programme assumes the current team can absorb new responsibilities, but the required technical, operational, or governance capability is absent or thinly staffed.

Impact: Delivery slips, controls are misapplied or left half-implemented, and the organisation may create avoidable exposure by deploying a capability it cannot reliably run.

Practitioner Guidance

Governance implication: Treat fit gap analysis as a decision tool, not a workshop exercise. The result should identify who owns each gap, whether it is accepted, and what change closes it, whether that is training, role redesign, process design, or external support.

What to watch for: The most dangerous gaps are often the ones that seem “small” but sit on a critical path, such as approval workflow, access review cadence, or operational support coverage. If a gap affects sustainment, not just launch, it deserves prioritisation.

Practitioner takeaway: A useful fit gap review ends with a defendable operating choice, not just a list of missing capabilities.

Related resources from NHI Mgmt Group

• How should organisations use a Zero Trust gap analysis in practice?
• What breaks when a CMMC gap analysis is treated like paperwork instead of validation?
• How do security teams know whether a CMMC gap analysis is producing usable results?
• What is the difference between a data map and a gap analysis for CCPA compliance?