GRC › Module 8 › Lesson 1
Gap Analysis
Gap analysis literacy — control requirement, current state, gap description, risk rating stub, remediation priority — named gap rows on YOUR `$GRC_LAB` audit findings.
Visual · t37_gap_analysis
Gap analysis = named finding rows. $GRC_LAB. Original Cyberlium.
Opening
Gaps between required and actual state drive remediation — name gap rows on YOUR lab findings before hiding gaps or forging pass results for certification fraud.
Gap analysis literacy names: control requirement row category, current state assessment category, gap description category, risk rating stub category, and remediation priority category. Analyst documents gap register on `$GRC_LAB` — three gaps from Module 7 audit summary with honest current state — without hiding gaps from reports, without marking all controls pass without evidence, without forging gap closure for external audit fraud. Cyberlium teaches gap vocabulary on YOUR notes labeled LAB. Refused: hidden gaps, forged pass results, fake remediation closure. Lab row: gap register (three gaps, requirement, current state, priority, LAB label).
1. Named gap rows
Requirement, current state, gap description, risk rating, priority — five literacy anchors.
Each gap links Module 7 audit exception — same org thread.
Command guide
Try these commands — Named gap rows
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: NIST CSF (https://www.nist.gov/cyberframework); ISO 27001 gap (https://www.iso.org/isoiec-27001-information-security.html); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Honest current state
Current state cites LAB evidence or honest partial — not assumed pass.
Risk rating stub documented before priority — not inflated for drama or minimized for fraud.
3. Refused
No hidden gaps; no forged pass without evidence; no fake closure dates.
Gap literacy supports remediation — not compliance theater.
4. What you ship: gap register
Three gaps + requirement + current state + priority + NEVER hidden gap line.
5. What you record before the next lesson
Gap register path.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark all `$GRC_LAB` controls pass without evidence to forge clean gap report for certification fraud.
Right
Gap register from `$GRC_LAB` audit findings. Next: Evidence Hygiene.
Mission: gap register
1) Name five gap analysis literacy rows. 2) Three gaps from Module 7 audit. 3) Honest current state and priority each. 4) Write NEVER hidden gap line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Risk rating vs priority — literacy split?”
Knowledge Check
APPLY: Gap analysis literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Hiding gaps from audit reports is acceptable.
True or False
Knowledge Check
APPLY: Gap register includes:
Multiple choice