a quantitative methodology for information security control gap analysis
From information security point of view, an enterprise is considered as a collection of assets and their interrelationships. These assets contain vulnerabilities, which may be exploited by threats to breach information security aspects of enterprises. In order to prevent this, security controls need to be implemented. It is important to analyze the gaps that exist in the implementation of controls in an enterprise. The present study proposes such a control gap analysis methodology.
control gap analysis information security measurement