Gap Analysis Template for Evidence-Backed Gaps

Build the delta from comparable evidence

Keep each comparison narrow enough that the current state and target use the same definition, unit, direction, and period. Preserve the evidence before interpreting what the gap means.

1. Bound the subject and dimension

   Name the organization, service, process, or capability in scope, then define one dimension without importing rankings, SWOT factors, risks, causes, options, or project work. A profile can describe current and target outcomes while leaving implementation choices to their owners.

   Sources: [nist-profiles], [nist-sp-1301], [opm-hcf]

2. Define the metric, unit, and desired direction

   State exactly what is measured, whether higher or lower is better, and whether the target is a scalar or range. Do not compare percentages with hours or a count with a rate. The JSON Schema and validator close each object so hidden units or decision fields cannot silently change the record.

   Sources: [gap-pack], [json-schema-2020-12]

3. Capture the current state with dated evidence

   Record the value, as-of date, source IDs, confidence, and rationale. Keep observations within a declared evidence cutoff. The AQuA Book emphasizes proportionate quality assurance for analysis, while the Human Capital Framework uses evidence and outcomes to inform evaluation.

   Sources: [aqua-book-2025], [opm-hcf], [gap-pack]

4. Define the target and its basis

   Record the target value or range, effective date, source IDs, confidence, and rationale. A target profile expresses intended outcomes; it is not itself approval, strategy, a roadmap, or evidence that the outcome will occur.

   Sources: [nist-profiles], [nist-sp-1301], [gap-pack]

5. Recompute the delta and expose assumptions

   Select absolute, percentage-point, relative, or target-range calculation, store the exact formula and tolerance, and independently recompute the result. Reject a zero relative denominator, mismatched direction or unit, invalid range, or result outside tolerance instead of repairing it silently.

   Sources: [gap-pack], [aqua-book-2025]

6. Review, expire, and hand off externally

   Name the accountable analysis owner, review date, expiry date, and review triggers. Send any recommendation, approval, prioritization, project plan, task, execution, or outcome tracking to an external accountable system. The gap ledger records the handoff reference but does not absorb that authority.

   Sources: [gap-pack], [opm-hcf], [json-schema-2020-12]

The gap-analysis boundary

Use this record to compare a sourced current state with a sourced target using one consistent measure. Stop before analysis becomes diagnosis, recommendation, approval, or execution.

Three neutral gap records

These fictional patterns show how the same ledger handles exact targets, percentage points, and target ranges without becoming a plan or outcome claim.

Decide whether the gap is reviewable

A polished table is not reviewable when its states are incomparable, stale, or unsupported. Stop and repair the evidence contract before interpreting the gap.

1. The current and target states use different metrics, units, directions, or periods.

   Choose: Split or redefine the dimension until both states use one explicit comparison contract, then collect the evidence again.

   Tradeoff: The table may contain fewer rows, but an invalid subtraction no longer appears precise.

2. A source is missing, dated after the cutoff, stale at review, or has no confidence rationale.

   Choose: Mark the gap unready and obtain a current authorized source before calculation or handoff.

   Tradeoff: Review waits, but an old or unattributed value does not become a current fact.

3. The stored result differs from the recomputed formula beyond tolerance.

   Choose: Block the record, fix the input or declared calculation, and rerun validation instead of editing the result alone.

   Tradeoff: The artifact remains strict, but a presentation error cannot silently alter the gap.

4. The requested output is a recommendation, priority, approval, project plan, task, or actual outcome.

   Choose: Freeze the reviewed gap and hand its stable reference to the external accountable owner and system.

   Tradeoff: The ledger stops before action, but evidence work does not acquire hidden decision or execution authority.

What this template cannot prove

A strict ledger can expose inconsistent measures, stale evidence, and hidden assumptions. It cannot decide whether a target is desirable or prove what will close the gap.

• A source-backed current state is limited to its scope, date, definition, collection method, and confidence rationale.
• A target is an intended state with a recorded basis, not a benchmark, approval, strategy, commitment, forecast, or guarantee.
• A calculated delta does not identify root cause, rank remedies, justify investment, assign priority, create a plan, execute work, or attribute an outcome.
• This ordinary informational article is AI-credit-ineligible. Product entry eligibility follows the current route policy.

Sources and verification record

These primary references and the same-release artifact were checked on 2026-08-01. They support current-versus-target framing, evidence quality, human-capital outcomes, schema structure, and the locally verified pack without reviewing this article or any real analysis.

1. [nist-profiles] National Institute of Standards and Technology:Cybersecurity Framework Profiles

   Checked August 1, 2026. Supports: Using current and target profiles to describe present and intended outcomes while keeping implementation choices outside the profile comparison.

2. [nist-sp-1301] National Institute of Standards and Technology:NIST SP 1301: NIST Cybersecurity Framework 2.0 Quick-Start Guide for Creating and Using Organizational Profiles

   Checked August 1, 2026. Supports: The current-profile and target-profile method and using their comparison to identify and analyze gaps.

3. [opm-hcf] U.S. Office of Personnel Management:Human Capital Framework reference materials

   Checked August 1, 2026. Supports: Evidence-informed evaluation, intended outcomes, measures, and accountable review in a human-capital context.

4. [aqua-book-2025] UK Government:The AQuA Book: guidance on producing quality analysis for government

   Checked August 1, 2026. Supports: Proportionate analytical quality assurance, transparent assumptions, evidence, and review of analysis.

5. [json-schema-2020-12] JSON Schema:JSON Schema Draft 2020-12

   Checked August 1, 2026. Supports: The declared schema vocabulary used by the closed machine-readable record.

6. [gap-pack] Playcode:Gap analysis fictional example

   Checked August 1, 2026. Supports: The locally reviewed fictional values, four calculation kinds, source and date rules, confidence, assumptions, owner and review fields, external handoffs, schema, validator, security boundaries, and 89 native tests. Public availability remains unverified until deployment.

Gap analysis template FAQ