Compliance is not a binder on a shelf. It is a set of claims you make and the evidence that supports them. Auditors, insurers, enterprise customers, and regulators all ask the same question in different words: show me that the control you say you have is actually operating. This guide explains who each framework applies to, what evidence looks like, and how a gap analysis differs from an audit.
Compliance Is Evidence, Not a Binder
Most failed compliance efforts do not fail because the policies are wrong. They fail because nobody can prove the policy was followed. A password policy that exists but has no enforcement report is a liability, not a control. A risk analysis written three years ago and never revisited describes a company that no longer exists.
Three things make evidence credible: it is generated by a system rather than by hand, it covers the whole period in question, and it names an owner. Screenshots of a console setting with a date are worth more than a paragraph in a document.
Framework Comparison
| Framework | Who it applies to | Core requirement | Evidence | When it is triggered |
|---|---|---|---|---|
| NIST CSF 2.0 | Any organization; voluntary in most sectors | Govern, identify, protect, detect, respond, recover, expressed as outcomes | Current-state profile, target profile, prioritized gaps | Customer questionnaires, insurer reviews, internal program build |
| NIST SP 800-53 | Federal systems and contractors; widely adopted as a control catalog | Control catalog with baselines from low to high impact | Control implementation statements mapped to the chosen baseline | Federal work, FedRAMP-adjacent products, enterprise security programs |
| NIST SP 800-171 | Defense contractors and subcontractors handling controlled unclassified information | 110 security requirements for protecting CUI | System security plan, control mapping, assessment results, remediation plan | Defense contracts and subcontracts that specify it |
| HIPAA Security Rule | Covered entities and business associates handling protected health information | Administrative, physical, and technical safeguards, plus a documented risk analysis | Risk analysis, policies, access reviews, audit logs, training records, business associate agreements | Handling PHI, in any size practice |
| PCI DSS 4.0 | Anyone who stores, processes, or transmits cardholder data | Twelve requirement groups, with the newer version emphasizing continuous monitoring and targeted risk analyses | Self-assessment questionnaire or assessment report, configuration standards, scan results, segmentation proof | Accepting cards, or processing them as a service provider |
| ISO/IEC 27001 | Any organization; increasingly required by enterprise and international customers | An information security management system with risk treatment and continual improvement | Scope statement, risk register, statement of applicability, internal audit, management review | Customer requirements, tenders, cross-border work |
| GDPR | Anyone processing personal data of people in the EU or UK | Lawful basis, data subject rights, breach notification, processor agreements | Records of processing, retention schedule, DSAR log, transfer safeguards | EU or UK customers, staff, or website visitors |
| Virginia CDPA | Businesses meeting the Virginia thresholds for consumer data processing | Consumer rights, transparency, purpose limitation, security duties, processor contracts | Privacy notice, data inventory, consumer request procedures, contract clauses | Serving Virginia consumers above the statutory thresholds |
Framework reference pages: NIST Cybersecurity Framework, NIST SP 800-171, HHS HIPAA Security Rule, PCI Security Standards Council, ISO/IEC 27001.
What a Gap Analysis Produces
A gap analysis answers one question: given this framework and this scope, where are we short, and what does closing the gap cost? It runs in seven steps.
- Scope. Which systems, locations, data types, and entities are in, and which are deliberately out.
- Asset inventory. What exists, who owns it, and what data it holds. Without this, every later step is guesswork.
- Control mapping. Map what you have to the framework’s requirements, in the framework’s own language.
- Evidence review. Read the actual policies, configurations, logs, and training records. Note where evidence is missing rather than assuming the control exists.
- Risk rating. Rank each gap by likelihood and business impact, not by which requirement sounds most alarming.
- Remediation plan. Each gap gets an action, an owner, a target date, and an estimate.
- Re-test. After remediation, check the same items again and record the result. This is where most programs stop too early.
A gap analysis is not a certification audit. Nobody certifies anything at the end of it. It tells you how far you are from being ready for one.
How to Prepare Without Buying Everything
Most organizations over-buy and under-document. Four things carry more weight than a new tooling stack: an asset inventory someone maintains, a risk analysis that matches the current environment, policies that staff can actually follow, and logs that prove the controls operate. If you must choose where to spend first, spend on getting the inventory and the evidence right.
Then sequence the work: close the gaps that reduce real risk and appear in several frameworks at once (MFA, patching, backups, access reviews, logging, training, incident response). One control effort can satisfy NIST, HIPAA, PCI DSS, and ISO language simultaneously. That overlap is where compliance stops being four separate projects.
Common Failure Points
- No asset inventory. You cannot protect, patch, or scope what you have not listed.
- No current risk analysis. Required under HIPAA, expected under every other framework, and frequently a stale document from three years ago.
- Policies nobody follows. Written for an auditor, contradicted by daily practice.
- Missing evidence. The control works, nobody kept the record, so it does not count.
- Vendor management. Third parties hold your data with no agreement, no review, and no monitoring. The 2026 DBIR found third-party involvement in 48% of breaches, up 60% year over year.
- Training records. No completion tracking means no proof the awareness program exists.
- Incident response plan never tested. A plan that has not been exercised is a document, not a capability.
- Access reviews not performed. Former staff and stale admin accounts remain, undocumented.
How Envescent Helps
We assess, map, and write: compliance assessment and gap analysis, risk assessment, policy development, and virtual CISO support for organizations that need an owner for the program rather than another report.
Our limits are part of the service, so state them plainly: we are not a certification body. ISO 27001 certification audits are performed by accredited registrars, and PCI DSS on-site assessments may require a Qualified Security Assessor. We do not provide legal advice; interpretation of a regulation for your situation belongs with your counsel.
Rates: $200 per hour during regular hours, $275 after hours or in an emergency, published in the service menu. The first consultation is free for up to an hour.
Background reading: the updated NIST Cybersecurity Framework, navigating US data privacy laws, the Virginia Consumer Data Protection Act, SEC guidance for investment managers, and DMARC, DKIM, and SPF requirements.
Request a gap analysis Start with the security basics