When it comes to your small business’s compliance and security, a gap analysis goes a long way. Without it, your team can be quickly blindsided. But just what is a gap analysis, and how does it help? Let’s take a look.
What is a Gap Analysis?
In its most basic form, gap analysis is a method that compares current performance with your desired performance. It assists organizations:
- In evaluating the difference (or gap) between the two.
- By uncovering missing strategies, skills, technologies, or processes.
- By informing what steps need to be taken to reach the goal
Benefits of an Analysis
When conducting one internally or seeking a gap analysis from a managed service provider (MSP), you can effectively tackle security gaps by following a prioritized action plan. This plan considers mission drivers, performs a cost/benefit analysis, and assesses risks to accomplish the desired goal.
What’s so great about it is that it equips executives with the necessary information to determine what resources they need to address gaps. It enables:
- Effective risk management.
- Targeted, cost-effective improvements.
- Informed decision-making regarding cybersecurity activities.
Why is a Gap Analysis Vital?
Recently, Practicefirst Medical Management Solutions, located in New York, agreed to pay a $550K fine after a 2020 ransomware attack impacted 1.2 million people nationwide. The practice management software vendor became vulnerable after failing to update a critical vulnerability nearly two years before the attack.
Making matters worse, the company failed to encrypt personal information on its servers and conduct regular security testing – violating not only federal HIPAA regulations but also New York state laws.
Had Practicefirst conducted a gap analysis, and penetration testing, they could have mitigated the risk to their organization and better-protected patient data. Here are Justin Weeks’, Teal VP of Cybersecurity and Compliance, thoughts:
“A gap analysis could have shown them the controls they needed. For example, if we did a gap analysis and they didn’t have security monitoring or hard drive encryption, they should because it exposes them to a large amount of liability. They could have been able to mitigate the risk. Additionally, always remember that not patching is likely going to be found negligent - depending on the circumstances and the location you are in.”
