What a gap assessment should cost and produce
A gap assessment measures your systems against a named framework and should produce a status for every requirement, a score, and a dated remediation plan. The Defense Department estimates a small firm's own Level 2 self-assessment at $34,277 and an independent certification assessment at $101,752. Specify the deliverable before you agree a price.
- No standard defines a gap assessment. NIST's glossary has no entry for the phrase, so the words on a proposal promise you nothing.
- An audit is defined as an independent review. A control assessment is not, which is why your provider can honestly assess its own work.
- The Defense Department publishes the price in three phases: $14,426 to plan and prepare, $15,542 to conduct, and $2,851 to report a Level 2 self-assessment at a small firm.
- Demand a plan of action and milestones. NIST defines it as tasks, resources, milestones and scheduled completion dates, which makes it the one deliverable with a published shape.
- Federal rules bar an assessor from assessing an organization it consulted for within three years. Your managed IT provider is under no such rule.
What should a gap assessment cost and produce?
A gap assessment should produce a status for every requirement in the framework, a score, the written scope it was measured against, and a dated plan to close each gap. Expect the price to cover finding and reporting. Fixing is a separate budget.
The only published price for this work comes from the Department of Defense. In the rule creating its certification program it estimated a small firm's own Level 2 self-assessment and affirmation at $34,277, and it published the split: $14,426 to plan and prepare, $15,542 to conduct the assessment and $2,851 to report the results. An annual affirmation adds $1,459. Those figures cover the exercise alone. The Department states plainly that its estimates do not include implementation or maintenance costs.
That last line saves money. A gap assessment buys an accurate list of what is wrong. Closing it is a second quote, often from a second firm.
This guide covers the engagement and its deliverable. The frameworks themselves are in our cybersecurity compliance guide, the attestation question in is SOC 2 a certification, and who owns each control afterwards in the control ownership matrix.
What is a gap assessment, and how does it differ from an audit?
A gap assessment compares your current controls against a named compliance framework's requirements and lists what is missing. An audit does the same work independently. That one word is the difference, and it sits in the definitions.
NIST defines a control assessment as the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly. Nothing in that definition requires an outsider. It defines an audit as an independent review and examination of records and activities to assess the adequacy of system controls. So your provider can assess its own work honestly. It cannot audit it.
The phrase gap assessment is not defined in the standards at all. NIST's glossary returns nothing for it, and the closest entry, gap analysis, belongs to a training publication: comparing current learning program or activity performance with the desired, expected performance. The federal rule driving much of this demand defines assessment and names the Assessment Findings Report, and its definitions section carries no entry for a gap.
So the proposal tells you nothing about what arrives. Two firms can sell you a gap assessment at the same price. One returns a control-by-control finding list with owners and dates. The other returns a questionnaire and one slide of red, amber and green boxes. Both are defensible uses of an undefined phrase, so you have to specify the output yourself.
Three neighbouring exercises are not this one. A cybersecurity risk assessment scores threats by likelihood and impact rather than control status. An attestation is a signed opinion from a licensed firm. A readiness review is not a defined term at all, so specify it line by line.
Does a self-assessment count, or do you need an independent one?
A self-assessment counts wherever the rule allows one, and it is graded lower on purpose. Federal acquisition rules say so in the definition itself.
Defense rules name three levels. A Basic Assessment is a contractor's self-assessment that results in a confidence level of Low, because it is a self-generated score. A Medium Assessment adds a government review of that self-assessment plus a thorough document review. A High Assessment adds verification, examination, and demonstration of a contractor's system security plan and results in a confidence level of High.
Read what separates Low from High. Not better questions. Demonstration. Somebody watched the control work.
Independence has a published price. The same Department estimates a Level 2 certification assessment and affirmation at a small entity at $101,752, against $34,277 for the same 110 requirements assessed in house. It budgets 120 hours of a third-party assessor's time at $260.28 an hour. Three weeks of an outsider's attention costs roughly three times the in-house exercise.
Lead time moves the decision as much as price. The Department notes that planning and scheduling takes place 3 to 6 months in advance. A deadline inside that window cannot be met independently, so run a self-assessment first and say so in writing.
What a usable gap assessment produces, line by line
Start with the method, because NIST publishes it free and it names the output. The Cybersecurity Framework 2.0 gives five steps for building an Organizational Profile, and the fourth is the exercise you are being quoted for: analyze the gaps between the Current and Target Profiles, and create an action plan. A Current Profile specifies the Core outcomes that an organization is currently achieving (or attempting to achieve). A Target Profile specifies the desired outcomes that an organization has selected and prioritized for achieving its cybersecurity risk management objectives. The instruction itself is one sentence: conduct a gap analysis to identify and analyze the differences between the Current and Target Profiles, and develop a prioritized action plan (e.g., risk register, risk detail report, Plan of Action and Milestones) to address those gaps.
Read what that sentence does and does not do. It never defines the phrase a provider is selling you, which is why the glossary search above comes up empty. It does specify the method, the two things being compared and the deliverable, and it calls that deliverable a prioritized action plan rather than a report. You do not have to be a defense contractor to use any of it. So the framework-agnostic version of this whole article is four words long: buy the action plan.
A usable gap assessment produces six artefacts. Each one exists in a published rule, so none is an unreasonable ask.
- A status for every requirement. Met or not met, per requirement, with the identifier quoted. Level 1 covers the fifteen requirements at 48 CFR 52.204-21(b)(1)(i) through (xv), and Level 2 covers the 110 security requirements derived from NIST SP 800-171 Revision 2.
- A score from a published scoring methodology. The maximum score equals the total number of requirements, and each unmet requirement subtracts 5, 3 or 1 point. Deductions may result in a negative score.
- The assessment scope it was measured against. An asset inventory, a system security plan and a network diagram, each one documented before anyone starts.
- The evidence behind each status. Assessors use one of three methods, examine, interview or test. Ask which one produced each finding.
- A remediation plan with dates. Named below, and the most useful thing to demand.
- A written findings report. The rule names the artefact: an Assessment Findings Report is the final written assessment results by the third-party or government assessment team.
Partial credit is the detail that exposes a lazy report. Three points come off if multi-factor authentication covers only remote and privileged users, and five if it covers nobody. Encryption that is not FIPS-validated costs three points rather than five. A line reading MFA: partial teaches you nothing. A line reading MFA: remote and privileged only, 3 points, tells you what to buy on Monday.
Somebody has to hold the evidence. The rule requires evidence artifacts to be retained for six years from the status date. If the assessor keeps the evidence and you keep the slide, you own nothing. What auditors ask for and nobody keeps is covered in the audit evidence an auditor asks for that nobody collects.
Demand a plan of action and milestones by name
To get a remediation plan you can hold someone to, ask for a plan of action and milestones. That phrase has a published definition. Gap assessment does not.
NIST defines it as a document that identifies tasks that need to be accomplished, detailing resources required, milestones for meeting the tasks, and the scheduled completion dates for the milestones. Four columns. Task, resource, milestone, date. A finding with no date is not a plan, and a plan with no named resource is a wish.
The federal rules then limit what may sit on one, and that is the part worth copying. A POA&M is not permitted at any time for Level 1 self-assessments. At Level 2 it covers only select requirements scored as NOT MET, none with a point value greater than 1, and only where the assessment score divided by the total number of requirements is at least 0.8. Six requirements are excluded outright, including the system security plan itself.
And it expires. The closing of a POA&M must be confirmed by a closeout assessment within 180 days, or the conditional status will expire. Borrow that mechanic even where this framework never applies to you. Every open row carries a date inside six months, and the biggest gaps must be remediated rather than parked.
A gap nobody intends to close is a different document. That decision belongs on a risk exception register with a named signatory and an expiry date, not on a plan that quietly never closes.
What decides the scope, and therefore the price
Four things decide the price of a gap assessment. How many requirements, how many assets, how the evidence is gathered, and whether remediation is included.
Requirement count moves it most, and the phase figures show where the hours land. A Level 2 self-assessment spends $14,426 to plan and prepare against $15,542 to conduct, so nearly half the money goes before anyone tests anything. Ask what the planning half produces, because that is where the asset inventory and the scope statement get written.
Asset scope is the lever a buyer can actually pull. The rule sorts every asset into five categories: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets, each with a different duty. Assets that cannot process, store or transmit the protected data need only a justification you can defend. Assets that handle it must be prepared for assessment against all Level 2 requirements. Scoping down is legitimate. Doing it without writing the justification is how a cheap assessment becomes a failed one. A scoped engagement is the only one anybody can price honestly.
Evidence method sets the hours. A questionnaire is examine at its weakest. A technician screen-sharing an admin console while you watch is test. Ask which method your price assumes, and for how many systems and sites.
Remediation is normally sold separately, and the Department's figures assume exactly that. Get two numbers on one page: the assessment, and a not-to-exceed estimate for closing the findings. A firm that will not estimate the second has not thought about your environment.
The conflict of interest worth naming out loud
An assessor who also sells the fix has an interest in the length of the finding list. The federal government writes that conflict into its own rules, with a number.
The rule requires the accreditation body to prohibit ecosystem members from participating in the Level 2 certification assessment process for an assessment in which they previously served as a consultant to prepare the organization for any CMMC assessment within 3 years. Three years. Not a disclosure, not a signed form. A bar.
No rule stops your managed IT provider from running your gap assessment and quoting the remediation. Most do both, and most are straight about it. The point is not suspicion. It is that the two can be bought separately, and asking shows you know the difference.
- Separate the quotes, so the finding list and the fix are priced on different pages.
- Name the person who signs the findings, with their credential.
- Hold the evidence artifacts yourself, in your storage, not the assessor's.
A firm that hands you a dated plan of action and milestones has assessed your controls. A firm that hands you a colour-coded slide has assessed your appetite for a project.
How to specify a gap assessment before you agree a price
To specify a gap assessment, name the framework, the scope, the output format and the evidence method in writing before you accept a quote. Seven lines are enough.
- Name the framework and its revision, not the family. NIST SP 800-171 Revision 2, not cybersecurity.
- Fix the assessment scope in writing. List the systems, the sites and the people, and say which assets you claim are out of scope and why.
- Require a met or not met status per requirement, with the identifier quoted on every line.
- Require a score, and ask which published scoring methodology produced it.
- Require a plan of action and milestones carrying a task, a resource, a milestone and a scheduled completion date in every row.
- Ask which evidence method produced each finding, out of examine, interview and test.
- Price remediation separately, as a not-to-exceed figure on its own page.
Regulated buyers have a second reason to get this right, because the obligation already exists. HIPAA requires a covered entity to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to electronic protected health information, and separately to perform a periodic technical and nontechnical evaluation establishing how far its security policies and procedures meet the rule. That second standard is a gap assessment in everything but name.
Ask your provider for two things this week. The last assessment you paid for, and the current status of every finding it raised, with a date against each one, so you can verify what actually closed. If the first is a slide and the second does not exist, you have not bought a gap assessment. You have bought a meeting.
FAQ
What is a gap assessment?
A gap assessment compares your current controls against a named framework's requirements and reports which ones are met. NIST defines the underlying exercise as the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly. The phrase itself has no standard definition, so specify the deliverable in writing.
How much should a gap assessment cost?
No neutral authority prices a commercial gap assessment. The closest published figure is the Defense Department's estimate of $34,277 for a small firm's own Level 2 self-assessment and affirmation, split into $14,426 to plan, $15,542 to conduct and $2,851 to report. Implementation costs are excluded from that estimate.
What is the difference between a gap assessment and an audit?
Independence. NIST defines an audit as an independent review and examination of records and activities, while its definition of a control assessment requires no outsider at all. Defense rules grade a contractor's self-assessment at a confidence level of Low because it is a self-generated score.
What should a gap assessment report contain?
Six things: a met or not met status per requirement, a score from a published method, the written scope, the evidence behind each finding, a plan of action and milestones, and a written report. The rule names that last artefact an Assessment Findings Report and defines it as the final written assessment results.
Can my IT provider run my gap assessment?
Yes, and price the remediation separately. Federal rules bar an assessor from participating in a Level 2 certification assessment where they previously served as a consultant within three years. No equivalent rule applies to a managed IT provider, so that separation is yours to ask for.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across North America. Organic ranking is earned on rating and verified data, and paid placement is always labelled. Take the seven-line specification to three merit-ranked firms in your city and compare what they promise to produce.