In February 2024, ransomware attackers breached Change Healthcare, a company that processes insurance claims and payments for healthcare providers across the US. According to JAMA Health Forum, the attack was linked to missing MFA on a legacy server. It disrupted claims and payments for healthcare providers nationwide, leaving some facing severe financial pressure. One missing security control at a technology vendor had consequences for roughly 190 million people
For SaaS vendors, this raises an important question. How many security weaknesses in your systems remain unnoticed until a customer review, compliance audit, or actual attack exposes them? A security gap analysis helps you find those weaknesses by comparing your current security practices against the controls and compliance requirements you need to meet.
This guide explains how to conduct a cybersecurity gap analysis, what it should cover, and how to turn the findings into a practical remediation plan.
What is Security Gap Analysis?
Cybersecurity gap analysis is the process of checking a company’s existing security measures against established cybersecurity standards or frameworks. It helps identify what security controls are missing, what needs improvement, and what is not working as expected.
For US organizations handling PHI, the standards used in a cybersecurity gap analysis depend on their regulatory obligations, customer requirements, and contracts.
Standard or framework
What the gap analysis assesses
Gaps in administrative, physical, and technical safeguards required to protect ePHI.
Gaps in implementing HIPAA Security Rule requirements, using NIST guidance.
Gaps in security governance, risk management, protection, detection, response, and recovery.
Gaps in security controls and supporting evidence against applicable Trust Services Criteria.
Gaps against applicable HITRUST security and privacy controls, including requirements mapped to HIPAA.
Gaps in information security management, risk treatment, and control implementation.
Gaps in protecting covered defense information, including applicable CUI, under relevant DoD contracts.
The HIPAA Security Rule is mandatory for applicable covered entities and business associates handling electronic PHI (ePHI). The other frameworks are generally voluntary or contract driven. NIST SP 800-66 provides HIPAA implementation guidance, while CMMC requirements apply to qualifying DoD contracts.
Why Is a Security Gap Analysis Important
A gap analysis shows exactly which controls are missing before a health system, auditor, or OCR finds them. It speeds up security reviews, prevents failed SOC 2 or HITRUST audits, and reduces the risk of HIPAA violation as a business associate.
Here’s how cybersecurity gap analysis helps.
Avoid Contract Delays Caused by Security Gaps
Before signing a SaaS vendor, healthcare organizations may request SOC 2 or HITRUST reports, detailed security questionnaires, and business associate agreements (BAAs).
Now, customers will closely examine your access controls, incident response plans, backups, and subcontractors. Without a clear picture of your security controls, you risk giving inconsistent answers or claiming safeguards that aren’t fully implemented. Some questionnaire responses can also become contractual commitments for you down the road.
A security gap analysis establishes which controls work, what evidence supports them, and what remains unresolved. You can then share a remediation plan with realistic timelines instead of making commitments you cannot meet.
Find Compliance Gaps Before the Audit Begins
SOC 2 Type II and HITRUST assessments require substantial time, money, and supporting evidence. Discovering missing controls during an audit can lead to delays, additional costs, or adverse findings. A gap analysis identifies these weaknesses before formal assessment.
It also helps you assess whether your current controls meet the framework your buyers expect. Some healthcare organizations require HITRUST certification, while others accept a SOC 2 Type II report alongside evidence of HIPAA compliance.
Knowing the requirements beforehand can prevent you from investing in an assessment that doesn’t satisfy your customers.
Reduce the Risk of Regulatory Violations
If your healthtech SaaS company handles electronic protected health information (ePHI) on behalf of a HIPAA-covered organization, you may qualify as a business associate.
Business associates have direct obligations under HIPAA, and the HHS Office for Civil Rights (OCR) can investigate violations.
A security gap analysis can reveal issues such as:
- Missing or incomplete HIPAA risk analyses
- Vendors processing ePHI without required BAAs
- Inadequate access and audit logging
- Former employees retaining access to sensitive systems
Identifying these gaps gives you an opportunity to address them before they contribute to a breach or regulatory investigation.
Uncover Hidden Security Risks in Your SaaS Architecture
Some of these security gaps come from everyday product features and integrations. For example:
- AI features: Your AI chatbot sends patient information to an AI provider without the required BAA. Patient details may also remain in conversation logs.
- EHR integrations: Your application has permission to access more patient records than it needs, or multiple systems use the same login credentials.
- Application logs: Error reports and monitoring tools accidentally capture patient names, medical details, or other sensitive information.
- Multi-tenant applications: Weak access controls allow one healthcare customer to view another customer’s patient records.
- Website tracking: Tracking pixels on patient portals send identifiable patient information to advertising platforms.
These issues may go unnoticed in a generic compliance checklist. But only a gap analysis covering your data flows, application architecture, and third-party services can expose them before they become more expensive to fix as your product grows.
Prepare for Changing Security and Compliance Requirements
The proposed HIPAA Security Rule changes include stricter requirements for MFA, encryption, asset inventories, vulnerability scanning, and penetration testing. As of October 2026, these changes have not been finalized.
A gap analysis can compare your existing controls against the current Security Rule and the proposed requirements. This helps you prioritize improvements that make sense now without implementing every proposed measure before the final rule is issued.
Strengthen Your Position During Investor, Acquisition, and Insurance Reviews
Investors and potential acquirers may review your HIPAA compliance, security policies, vendor agreements, and unresolved risks. Significant gaps can delay transactions or affect their terms. Cyber insurers also assess controls such as MFA, backups, endpoint protection, and incident response. Weaknesses may affect premiums or coverage.
A gap analysis in cybersecurity documents your current controls, outstanding risks, and remediation plans, giving you evidence to support these reviews.
The value of a gap analysis depends on how accurately it reflects your operations. A checklist cannot tell you that much. Which is why the assessment needs to examine both the controls you have documented and the evidence that supports them.
How to Perform a Security Gap Analysis in 6 Steps
A security gap analysis starts with a simple question: How well do your current security practices meet the requirements you’re expected to follow?
To answer that, you need to look beyond written policies and check what your organization actually does.
At KLEAP, we assess both. We work with your team to review existing practices, examine supporting evidence, identify gaps, and build a roadmap for addressing them.
Here’s how that process works.
Step 1: Define The Scope And Choose The Security Framework
Start by establishing which security standard or compliance requirements apply to your organization.
You may be preparing for SOC 2, working toward ISO 27001 certification, or assessing your security program against another framework.
We don’t start with a fixed checklist. We first discuss the client’s requirements and prepare an assessment checklist based on the applicable standard.
We already have checklists for frameworks we regularly work with. When a client needs a different one, we develop the checklist from that standard.
This establishes what needs to be assessed before we begin reviewing individual controls.
Step 2: Review Each Requirement with The Client's Team
Once you’ve defined the scope, the next step is to understand how your organization currently meets each requirement.
We work through the standard section by section, usually through weekly calls with the client’s team. Instead of simply asking whether a control exists, we ask how it works and what evidence supports it.
For example, suppose your organization has a policy requiring quarterly IT governance meetings. You would want to know:
- Are those meetings actually happening?
- Who participates?
- Are security risks and escalations discussed?
- Are decisions and action items recorded?
Your policy might state that governance meetings must happen every quarter. But if nobody can produce meeting records, we need to establish whether the meetings are happening at all. These missing evidence pointed to a larger problem with the underlying process.
Step 3: Assess The Organization's Maturity of Existing Security Controls
After reviewing the current practices and evidence, you need to assess how consistently those controls operate.
At KLEAP, we use a five-level maturity model.
Level
What it means
1. Initial / Ad Hoc
Practices are informal, inconsistent, or undocumented.
2. Repeatable
Basic practices exist, but formal approval and consistent implementation are missing.
3. Defined
Policies, responsibilities, and procedures are documented and established.
4. Managed
Control performance is measured and monitored through KPIs and KRIs.
5. Optimized
Continuous improvement is integrated into business operations and leadership decisions.
Most organizations we work with aim to reach Level 3, where governance processes are established and documented.
For example, if your team discusses security issues informally but has no established committee, meeting schedule, or documented responsibilities, the process may fall within the lower maturity levels.
We assess the current maturity based on the practices and evidence available, then identify what is needed to reach the target level. That rating helps you understand how developed your processes are. It doesn’t automatically mean you’ve satisfied every compliance requirement.
Step 4: Identify Gaps in Policies, Processes, And Evidence
Once you’ve assessed the controls, you can identify where the organization falls short.
In our assessments, documentation gaps come up frequently. A company may have an established process but no formal policy or records to demonstrate it.
Sometimes, the process itself doesn’t exist. For example, we’ve worked with organizations where IT, operations, and other departments were making security-related decisions independently. There was no committee responsible for discussing issues across teams or tracking the decisions made.
Writing an IT governance policy wouldn’t resolve that gap on its own. We need to establish who should participate in the committee, what they should discuss, which metrics they should review, and how decisions should be recorded.
We also frequently encounter generic security policies that don’t reflect how the organization actually operates.
When we help develop policies, we build them around the client’s existing operations and identify which practices need to change to meet the applicable requirements.
Step 5: Prepare A Gap Analysis Report and Remediation Roadmap
After identifying the gaps, you need a clear plan for closing them.
At KLEAP, we prepare a report that explains the organization’s current maturity level, identifies missing or outdated policies and procedures, and outlines the steps needed to reach the target maturity.
Take the missing IT committee for example. The roadmap might identify several actions:
- Establish an IT steering committee with appropriate representation.
- Define its responsibilities and meeting schedules.
- Create a process for discussing risks and escalations.
- Record decisions and track assigned actions.
This gives you a clear view of what needs to be implemented and why.
Step 6: Implement The Changes and Collect Evidence
The gap analysis is complete once you’ve established the current state and the roadmap for addressing the findings. Closing those gaps requires further work.
For example, establishing an IT steering committee means more than creating its charter. You need to conduct the meetings, review security issues, assign responsibilities, and maintain records of decisions. Those records help demonstrate that the process operates in practice.
The same applies to other security policies. Once implemented, you need to check whether teams are following them and whether the controls are producing the intended results. We encourage clients to review those results regularly and update their policies as their operations change.
The purpose of the gap analysis is to establish what needs improvement. The remediation then turns those findings into changes the organization can demonstrate.
A security gap analysis gives you a roadmap for improving your security posture. However, some findings may require further technical testing or a formal compliance assessment to establish whether the required controls are working.
Is Security Gap Analysis Similar to HIPAA Risk Analysis?
A security gap analysis and a HIPAA risk analysis are not the same, and one can’t replace the other. A gap analysis asks whether each required control exists and works. A risk analysis asks how likely a weakness is to be exploited and how much harm it would cause to ePHI. HHS guidance states that a gap analysis alone doesn’t meet HIPAA risk analysis requirement.
Here’s how they differ in scope, approach, and outcome.
Criteria
Security Gap Analysis
HIPAA Risk Analysis
Core question
Does each control exist and meet the requirements?
How likely is each threat, and how damaging it would be?
Required by HIPAA?
No. It’s the best practice that supports compliance.
Yes. Mandatory for covered entities and business associates under §164.308(a)(1)(ii)(A).
Scope
Controls, policies, and evidence measured against a chosen framework, such as HIPAA, SOC 2, or ISO 27001.
All ePHI you create, receive, maintain, or transmit, across systems, locations, and vendors.
Method
Document review, stakeholder interviews, and control-by-control mapping against requirements.
ePHI inventory and data-flow mapping, threat and vulnerability identification, and likelihood of impact ratings.
Output
Gap register and remediation roadmap.
Risk register with assigned risk levels, which drives your risk management plan.
When to run
Before audits, customer security reviews, and major product or vendor changes.
Ongoing. Update it when your systems, vendors, or threats change. Most organizations review it at least annually.
A security gap analysis comes before risk analysis. You first identify missing or weak controls, such as poor access management or missing vendor agreements. Next, you assess the likelihood and impact of each gap to understand the risks involved. Based on those findings, you build a remediation plan that prioritizes high-risk issues. This way, you know what needs fixing, how serious each issue is, and what to address first.
From Security Assessment to Remediation With KLEAP
A security gap analysis tells you which controls are missing or weak. But closing those gaps requires understanding the risks involved, checking technical weaknesses where needed, and deciding what to fix first.
At KLEAP, we bring security gap analysis, vulnerability testing, and compliance consulting together. Through our concierge approach, we work directly with your team to validate findings, prioritize risks, and build a remediation roadmap. We also support implementation so your team can put the required controls and processes in place.
Know where your security stands and what needs attention first.
Frequently Asked Question
What Are the Frameworks for A Security Gap Analysis?
Start with the HIPAA Security Rule, because it’s the legal baseline for anyone handling ePHI. Then add the framework your buyers require: SOC 2 for most digital health customers, HITRUST for large health systems, or ISO 27001 for international buyers. NIST CSF 2.0 works well as a unifying structure when you face several frameworks at once.
What Is Involved in A HIPAA Gap Analysis?
A HIPAA security gap analysis maps your administrative, physical, and technical safeguards against every required and addressable specification in the Security Rule. It covers where ePHI lives and flows, BAA coverage across vendors, access controls, audit logging, encryption, and incident response. The output is a prioritized finding register and remediation roadmap that feeds your required risk analysis.
Who Should Perform a Security Gap Analysis?
An independent assessor with healthcare compliance experience gives the most reliable result, since internal teams tend to grade their own controls generously. Pick one who isn’t your future SOC 2 or HITRUST auditor, because independence rules usually prevent that. Your engineering, product, and operations leads still participate, since they own the controls and evidence.
What Tools Are Used for a Security Gap Analysis?
Most teams combine a framework-mapped spreadsheet or GRC platform with technical tools. Compliance automation platforms track control status and collect evidence. Cloud security posture management tools check configurations, and vulnerability scanners test your app and APIs. Tools show what’s configured; an assessor still has to judge whether controls actually work.
How Do Cloud Security Tools Assist with Compliance Gap Analysis?
Cloud security tools continuously check your AWS, Azure, or GCP configuration against framework controls, flagging issues like unencrypted storage, public buckets, missing MFA, or disabled logging. They map findings to HIPAA, SOC 2, or NIST CSF and produce evidence automatically. They can’t assess policies, governance, or vendor BAAs, so they cover only part of a gap analysis.
When Should a Healthtech Startup Run a Security Gap Analysis?
Run one before signing your first health-system contract, before starting a SOC 2 or HITRUST audit, and after major architecture changes like adding AI features or a new EHR integration. Repeat it annually, and again once HHS finalizes the HIPAA Security Rule update, now expected no earlier than July 2027.
