Assessment — Compliance Gap Analysis¶

A template for identifying gaps between your current control implementation and the requirements of a target compliance framework. This assessment works with any framework — FedRAMP, SOC 2, HIPAA, PCI-DSS, CMMC, NIST CSF, or others — and maps identified gaps to CSA-in-a-Box capabilities that can accelerate remediation.

Framework selection guide¶

Start by identifying which compliance framework(s) apply to your organization. The table below maps common industries and scenarios to recommended frameworks.

If you need to satisfy multiple frameworks, start with NIST 800-53 Rev 5 as your control baseline. Most other frameworks (FedRAMP, CMMC, HIPAA, SOC 2) map to NIST 800-53 controls, so a single gap analysis against 800-53 can inform remediation across all of them.

Gap analysis process¶

Follow these five steps to complete the analysis:

flowchart LR
    A["1. Select Target<br/>Framework"] --> B["2. Map Current<br/>Controls"]
    B --> C["3. Identify<br/>Gaps"]
    C --> D["4. Prioritize<br/>by Risk"]
    D --> E["5. Create<br/>Remediation Plan"]

    style A fill:#e3f2fd
    style B fill:#e3f2fd
    style C fill:#fff3e0
    style D fill:#fff3e0
    style E fill:#c8e6c9

Step 1 — Select target framework¶

• Identify the compliance framework(s) required for your deployment
• Obtain the official control catalog (e.g., NIST 800-53 Rev 5 control catalog, PCI-DSS v4 requirements)
• Determine the applicable baseline or scope (e.g., FedRAMP Moderate vs. High, CMMC Level 1 vs. Level 2)
• Identify any agency-specific or customer-specific overlays (additional requirements beyond the base framework)

Step 2 — Map current controls¶

For each control in the target framework, document your current implementation state:

• Inventory existing policies, procedures, and technical controls
• Determine which controls are inherited from the cloud provider (Azure shared responsibility)
• Identify controls implemented by CSA-in-a-Box Bicep modules, policies, and configurations
• Document controls that your organization implements through operational processes
• Classify each control using the status codes defined below

Control status codes (aligned with CSA-in-a-Box compliance manifests):

Step 3 — Identify gaps¶

A gap exists when a control is in any state other than IMPLEMENTED, NOT_APPLICABLE, or INHERITED:

• Flag all PARTIALLY_IMPLEMENTED controls — document what is missing
• Flag all PLANNED controls — document the timeline and effort
• Flag all NOT_ASSESSED controls — schedule evaluation
• For INHERITED controls, verify the inheritance claim against the CSP's authorization documentation
• Document compensating controls where full implementation is not feasible

Step 4 — Prioritize gaps by risk¶

Score each gap on impact and likelihood to determine remediation priority:

• Assess the impact of non-compliance for each gap (data exposure, regulatory penalty, operational disruption)
• Assess the likelihood that the gap could be exploited or result in an audit finding
• Assign priority (Critical, High, Medium, Low) using the risk matrix below
• Group related gaps for efficient remediation

Priority matrix:

Step 5 — Create remediation plan¶

For each gap, document the remediation approach:

• Define the remediation action (implement control, configure service, write policy, deploy module)
• Identify the responsible owner
• Set a target completion date based on priority
• Estimate effort (hours/days) and resources needed
• Identify CSA-in-a-Box resources that address the gap (see resource mapping below)
• Define success criteria (how will you know the control is satisfied?)
• Plan evidence collection for future audits

Control mapping template¶

Use the following table format to document your gap analysis. Create one row per control in your target framework.

Common gaps by framework¶

The following sections identify the most frequently encountered gaps for each major framework. Use these as a starting point — not a substitute for a complete control-by-control analysis.

FedRAMP Moderate — Top gaps¶

For the complete FedRAMP control crosswalk, see FedRAMP Moderate.

SOC 2 Type II — Top gaps¶

For the complete SOC 2 TSC crosswalk, see SOC 2 Type II.

HIPAA Security Rule — Top gaps¶

For the complete HIPAA crosswalk, see HIPAA Security Rule.

PCI-DSS v4.0 — Top gaps¶

For the complete PCI-DSS crosswalk, see PCI-DSS v4.

CMMC 2.0 Level 2 — Top gaps¶

For the complete CMMC practice mapping, see CMMC 2.0 Level 2.

CSA-in-a-Box control mapping¶

The following table maps CSA-in-a-Box capabilities to common compliance control areas. Use this to identify which platform features address your identified gaps.

Remediation priority matrix¶

After completing the gap analysis, summarize your remediation priorities:

Remediation tracking¶

For ongoing tracking, maintain a remediation log:

Continuous compliance¶

Gap analysis is not a one-time activity. Establish ongoing compliance monitoring:

• Quarterly gap review — Reassess gaps and update remediation status
• Azure Policy compliance — Monitor Azure Policy compliance dashboard for configuration drift
• Defender for Cloud secure score — Track secure score trend as a proxy for security posture
• Automated evidence collection — Configure diagnostic settings and Log Analytics to generate audit evidence continuously
• Annual full assessment — Conduct a complete gap analysis annually or when the target framework updates
• Incident-driven review — Reassess relevant controls after security incidents

As FedRAMP moves toward OSCAL-formatted security packages, consider generating machine-readable control documentation from your CSA-in-a-Box deployment. This is on the CSA-in-a-Box Phase 2 roadmap. See Federal Cloud Adoption Trends for the latest on FedRAMP automation.

Related¶

• Migration Readiness Assessment — Pre-migration readiness evaluation
• Platform Maturity Model — Ongoing maturity assessment across 8 dimensions
• Assessment Templates Index — Overview of all assessment tools
• Compliance Documentation — Control mappings for NIST 800-53, FedRAMP, CMMC, HIPAA, SOC 2, PCI-DSS
• FedRAMP Moderate Guide — FedRAMP control crosswalk
• NIST 800-53 Rev 5 — NIST control mapping
• Security & Compliance Best Practices — Defense-in-depth patterns
• Federal Cloud Adoption Trends — Federal compliance landscape and trends

Last updated: 2026-04-30 Review cadence: Annual (or when target framework releases updates) Owner: CSA-in-a-Box platform team