Compliance gap assessment services
Compliance gap assessments: know where you stand before an auditor does.
A compliance gap assessment measures what an organization actually has in place against what its framework actually requires, control by control, evidence by evidence. CyNtell delivers a written finding for every requirement, not a general impression.
Compliance gap assessments at a glance
- What it is
- A structured comparison between the controls a standard requires and the controls an organization has actually implemented. Each requirement is examined, tested against evidence, and recorded as met, partially met, or not met.
- Frameworks CyNtell assesses
- HIPAA, PCI DSS, state privacy laws, NIST SP 800-171, and CMMC Levels 1 and 2.
- What it produces
- A control-by-control findings report and a remediation plan ordered by risk and effort.
- How it is priced
- A fixed fee scoped to the size of the assessment: people in scope, systems handling regulated data, cloud providers in the boundary, and physical locations. Not billed hourly.
- Where CyNtell operates
- Based in the Washington, DC area, serving clients nationwide.
What is a compliance gap assessment?
A compliance gap assessment is a structured comparison between the security and privacy controls a standard requires and the controls an organization has actually implemented. Every requirement is examined, tested against real evidence, and recorded as met, partially met, or not met, with a written basis for the call.
The output is not a grade. It is a worklist: what is missing, what it will take to close, and in what order. Most organizations use a gap assessment to build a budget and a schedule before committing to an audit, a certification, or a customer's security questionnaire.
What a gap assessment is not
Not an audit or a certification
No certificate is issued and no opinion is filed. A gap assessment is the work an organization does so that the audit goes well.
Not a penetration test
A penetration test asks whether an attacker can get in. A gap assessment asks whether controls, documentation, and evidence satisfy a specific published standard. Both are useful; they answer different questions.
Not a vulnerability scan
Scanning finds technical weaknesses in systems. A gap assessment also covers policy, process, training, physical security, and governance, the areas where most compliance findings actually land.
Not a self-completed questionnaire
CyNtell tests the evidence. A control that is documented but not consistently practiced is recorded as a gap, because that is how an assessor will record it.
Which standard are you being measured against?
Most organizations arrive knowing they have an obligation and not knowing how far off they are. Start with the framework that applies.
Healthcare and business associates
HIPAA
A HIPAA gap assessment covers the Security Rule, Privacy Rule, and Breach Notification Rule, measured against how an organization actually handles protected health information across administrative, physical, and technical safeguards. That includes the security risk analysis, which is the deficiency the HHS Office for Civil Rights cites most often in enforcement actions. Covered entities and business associates both.
Anyone who takes card payments
PCI DSS
A PCI DSS gap assessment begins with scoping, because most PCI difficulty comes from a cardholder data environment that grew wider than intended. CyNtell maps where card data is stored, processed, and transmitted, works requirement by requirement through the twelve, and confirms which self-assessment questionnaire or report on compliance the organization's merchant level and acceptance channels actually call for.
Consumer data, any sector
Privacy
A privacy gap assessment maps state privacy law obligations against real data flows: what an organization collects, why, where it goes, who it is shared with, and how long it is kept. CyNtell reviews notices, consent mechanics, data subject request handling, and vendor agreements against the statutes covering that organization's customers, so the gap list reflects its actual footprint.
Federal contractors and grantees
NIST SP 800-171
A NIST SP 800-171 gap assessment covers all 110 requirements across the systems that store, process, or transmit Controlled Unclassified Information. It produces the DoD Assessment Methodology score as it would be reported in SPRS, a system security plan review, and a plan of action for unmet requirements. This is the foundation CMMC Level 2 is built on.
Defense supply chain
CMMC Level 1 and 2
A CMMC gap assessment gives a defense contractor the full readiness picture before booking a certification assessment: scope and enclave design, evidence quality, and a costed remediation plan measured against the same objectives a C3PAO assessor will use. Whether an organization holds Federal Contract Information, Controlled Unclassified Information, or both, decides which level applies.
CMMC gap assessments in detail →When should an organization run a gap assessment?
A gap assessment is usually triggered by something specific rather than a general wish to improve. These are the six situations that most often prompt one.
A new clause appeared in an award
The organization won work and the contract carries a security requirement it has not had to meet before. The clock starts at award, not at renewal.
A customer sent a security questionnaire
A large client or prime contractor wants attestations the organization cannot currently support with evidence, and the answer is due in weeks.
Certification is on the calendar
An assessment or audit is booked, and the organization wants to know what will be found while there is still time to fix it.
A bid requires it
An RFP names a standard as a condition of award, and the organization needs to know whether to bid and what compliance will cost if it wins.
Something happened
An incident, a near miss, or a finding from someone else's audit exposed that the control environment is thinner than assumed.
Diligence
An acquisition, an investment, or an insurance renewal put the organization's security posture in front of someone who will check it.
How does a CyNtell gap assessment work?
CyNtell runs every compliance gap assessment in four stages.
Scope
CyNtell and the client agree what is in and out: which systems, which locations, which people, which data. Scope is where assessments go wrong, and a scope drawn wider than it needs to be is the most expensive mistake in compliance, so it is settled in writing before anything else starts.
Examine, interview, test
CyNtell reads the policies, inspects the configuration, and talks to the people doing the work. Three things have to agree: what the document says, what the system does, and what the person actually does on a Tuesday. Where they diverge, that is a finding.
Score and document
Every requirement receives a status and a written basis. Where the organization falls short, the finding names specifically what is missing: a policy that does not exist, a setting that is not enforced, a record that cannot be produced, rather than simply that something is wrong.
Plan the remediation
Gaps are returned ordered by risk and by effort, so the client can see what to fix this quarter, what needs budget, and what can wait. The plan is delivered whether or not CyNtell is asked to do the remediation work.
Why organizations bring this to CyNtell
CyNtell has spent its working life inside regulated environments: commercial businesses answering to HIPAA, PCI DSS, and state privacy law, and federal contractors answering to NIST SP 800-171 and CMMC. CyNtell is an Authorized C3PAO, which means its people spend their days applying the same assessment methodology a certification body will apply to a client. A CyNtell gap assessment is calibrated to what actually gets accepted as evidence, not to what sounds reasonable.
It also means CyNtell will say when the answer is uncomfortable. An assessment that reports everything is fine, when it is not, costs an organization far more later than it saves now.
CyNtell is based in the Washington, DC area and serves clients nationwide.
Questions we get first
Compliance gap assessment FAQ
What is the difference between a gap assessment and a gap analysis?
There is no meaningful difference. Gap assessment and gap analysis describe the same engagement: a control-by-control comparison of an organization's current practices against what a standard requires, ending in a documented remediation plan. CyNtell uses the two terms interchangeably.
How is a compliance gap assessment different from an audit?
An audit issues an opinion or a certificate against a standard. A gap assessment does not: it is the preparation an organization does beforehand, measuring current controls against the requirement so it knows what to fix before an auditor arrives. No certificate is issued and no opinion is filed. A gap assessment is the work that makes the audit go well.
Which framework applies if an organization handles several kinds of regulated data?
More than one can apply at once, and they often do. An organization taking card payments and handling protected health information answers to both PCI DSS and HIPAA, and a federal contractor may carry NIST SP 800-171 or CMMC on top of a state privacy law. CyNtell scopes each obligation against the data it actually governs, so the findings reflect every framework in play rather than forcing the organization into one.
How much disruption does a gap assessment cause?
Little. Most of the work is document review, configuration inspection, and short interviews with the people who run the controls. Those conversations are scheduled around the team's day rather than halting it, and CyNtell scopes the boundary up front so no one spends time on systems that are out of scope.
Does CyNtell perform the remediation as well?
It can, and the remediation plan is delivered whether or not it does. Some clients close the gaps with their own team using the plan as a worklist; others ask CyNtell to do some or all of the work. The one exception is CMMC: where CyNtell performs readiness or remediation, an independent C3PAO performs that organization's certification assessment, because the rules keep preparation and certification apart.
What does a compliance gap assessment cost?
A fixed fee, scoped to the size of what is being assessed: the number of people in scope, the systems handling regulated data, the cloud footprint, and how many physical locations are involved. It is not billed hourly. Send those four things and CyNtell will quote it.
Start here
Tell us where you stand. We will tell you what it takes.
A 30-minute scoping call: what sits inside your boundary, where your risk really stands, and the shortest defensible path, whether that is a certification, a compliance framework, or a security program that runs itself.
CyNtelligent Solutions, LLC (CyNtell), cybersecurity, compliance, and IT security operations for the federal government, the defense industrial base, and regulated industry.
Assessor independence. CyNtelligent Solutions, LLC (CyNtell) is an Authorized C3PAO, listed on the Cyber AB Marketplace. CMMC certification assessment work and consulting engagements are delivered by separate engagement teams, and never the same personnel on an assessment and the advisory work behind it. Consistent with Cyber AB conflict-of-interest requirements, CyNtell does not perform a certification assessment of an environment it has consulted on.
Page reviewed September 2026. Copyright 2026 CyNtelligent Solutions, LLC. All rights reserved. Privacy policy. Flying Fox, Fognigma, and The Guard are trademarks of their respective owners.