SOC 2 Gap Analysis: How to Run One | Osto<\/title>\n<meta name=\"description\" content=\"A clean, practical guide to running a SOC 2 gap analysis. What it is, how it differs from a readiness assessment, the step-by-step process, the gap register, scoring, and closing gaps faster.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .regtable{width:100%;border-collapse:collapse;margin:22px 0;font-size:13px;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .regtable th{background:#1c267a;color:#fff;text-align:left;padding:11px 14px;font-size:12px;letter-spacing:.03em}\n .regtable td{padding:10px 14px;border-bottom:1px solid var(--mist);color:var(--ink)}\n .regtable tr:last-child td{border-bottom:none}\n .regtable tr:nth-child(even) td{background:#fafbff}\n\n\n .procribbon{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0 6px;background:linear-gradient(135deg,#1c267a,#3a46c0);border-radius:14px;padding:16px 14px}\n .procribbon .pr{flex:1;min-width:90px;text-align:center;color:#fff;padding:4px 6px}\n .procribbon .pr .pn{font-size:11px;font-weight:800;opacity:.7}\n .procribbon .pr .pt{font-size:12.5px;font-weight:700;margin-top:2px;line-height:1.25}\n .procribbon .parr{color:rgba(255,255,255,.5);font-size:15px;font-weight:700;padding:0 2px}\n @media(max-width:640px){.procribbon{flex-direction:column;align-items:stretch}.procribbon .parr{display:none}.procribbon .pr{text-align:left;padding:6px 8px;border-bottom:1px solid rgba(255,255,255,.15)}}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}\n .bbox.indigo{border:2px solid #3a46c0}\n .bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n\n<div class=\"wrap\">\n <p class=\"dek\">A SOC 2 gap analysis is the diagnostic step that tells you exactly where you stand before an auditor does. Find the gaps while they are still easy to fix.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span>\n <span class=\"dot\"><\/span>\n <span>8 min read<\/span>\n <span class=\"dot\"><\/span>\n <span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A SOC 2 gap analysis measures the distance between the controls you have today and what the Trust Services Criteria require. It is the diagnostic you run first, so you find and fix problems while they are still private.<\/p>\n <p>The process: define scope, map each criterion to your controls, mark every gap, score it by severity, assign an owner and deadline, then remediate. The output is a gap register that drives everything downstream.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What it is<\/a><\/li>\n <li><a href=\"#vs\">Gap vs readiness<\/a><\/li>\n <li><a href=\"#exception\">Gap vs exception<\/a><\/li>\n <li><a href=\"#steps\">The 6 steps<\/a><\/li>\n <li><a href=\"#register\">The gap register<\/a><\/li>\n <li><a href=\"#scoring\">Scoring gaps<\/a><\/li>\n <li><a href=\"#osto\">Closing faster<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What a SOC 2 gap analysis is<\/h2>\n <p>A SOC 2 gap analysis is a structured comparison: your current controls on one side, the SOC 2 Trust Services Criteria on the other, and a clear list of the differences in between.<\/p>\n\n <div class=\"analogy\"><strong>Why it exists:<\/strong> most companies genuinely do not know where they stand. They have security practices, some formal, some informal, some documented, some living only in an engineer’s head. A gap analysis turns that fog into a concrete, prioritised list.<\/div>\n\n <h2 class=\"sec\" id=\"vs\">Gap analysis vs readiness assessment<\/h2>\n <p>These terms get used loosely, so here is the clean distinction.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">Gap analysis<\/div><div class=\"big\">The diagnostic core<\/div><div class=\"sm\">Mapping controls to criteria and listing what is missing. This is where the real intelligence comes from.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">Readiness assessment<\/div><div class=\"big\">The broader phase<\/div><div class=\"sm\">Contains the gap analysis, plus remediation and a final self-check. You run the gap analysis as its first and most important part.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"exception\">A gap is not an exception<\/h2>\n <p>This is the single most useful concept to hold onto, because it explains why the whole exercise is worth it.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k2\"><div class=\"lab\">A gap<\/div><div class=\"big\">Private, and fixable<\/div><div class=\"sm\">Found before or during your own readiness work, while there is still time to fix it quietly. A private to-do item.<\/div><\/div>\n <div class=\"k1\"><div class=\"lab\">An exception<\/div><div class=\"big\">Public, and costly<\/div><div class=\"sm\">What the auditor documents when a control fails during formal testing. It can land in your final report, where buyers read it, and delay certification.<\/div><\/div>\n <\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">THE ENTIRE POINT<\/div>a gap analysis converts would-be exceptions into gaps you have already closed. Every gap you find and fix now is an exception that never makes it into the report.<\/div>\n\n <h2 class=\"sec\" id=\"steps\">How to run one, step by step<\/h2>\n <p>Run your SOC 2 gap analysis before you sign an engagement letter, ideally three to six months before you want your observation window to open. It is a cross-functional exercise, not a one-person spreadsheet.<\/p>\n\n <div class=\"procribbon\">\n <div class=\"pr\"><div class=\"pn\">01<\/div><div class=\"pt\">Scope<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">02<\/div><div class=\"pt\">Map controls<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">03<\/div><div class=\"pt\">Flag gaps<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">04<\/div><div class=\"pt\">Score<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">05<\/div><div class=\"pt\">Assign owners<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">06<\/div><div class=\"pt\">Remediate<\/div><\/div>\n <\/div>\n\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Define scope<\/h4><\/div><ul><li>Which systems and data are in scope<\/li><li>Which criteria apply (Security is mandatory)<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Map controls to criteria<\/h4><\/div><ul><li>Go CC1 through CC9, plus any optional<\/li><li>Note the control that satisfies each, if any<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>Flag every gap<\/h4><\/div><ul><li>No control, undocumented, or no <a href=\"https:\/\/www.osto.one\/resources\/soc-2-evidence-collection\">evidence<\/a><\/li><li>Each of these counts as a gap<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Score by severity<\/h4><\/div><ul><li>How likely to cause an exception<\/li><li>How much real risk it carries<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">5<\/span><h4>Assign owners<\/h4><\/div><ul><li>A named owner with authority and resources<\/li><li>A realistic due date. Unowned gaps do not close<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">6<\/span><h4>Remediate & verify<\/h4><\/div><ul><li>Work the register, close each gap<\/li><li>A short internal re-test confirms readiness<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"register\">Building the gap register<\/h2>\n <p>The concrete deliverable is a gap register: a control mapping matrix that tracks each requirement, its status, and its path to closure.<\/p>\n\n <table class=\"regtable\">\n <tr><th>Column<\/th><th>What it captures<\/th><\/tr>\n <tr><td><strong>Criterion<\/strong><\/td><td>The SOC 2 requirement (CC1 through CC9, plus optional)<\/td><\/tr>\n <tr><td><strong>Existing control<\/strong><\/td><td>The control you have that satisfies it, if any<\/td><\/tr>\n <tr><td><strong>Gap status<\/strong><\/td><td>Met, partial, or missing<\/td><\/tr>\n <tr><td><strong>Severity<\/strong><\/td><td>How likely to cause an exception, and the risk it carries<\/td><\/tr>\n <tr><td><strong>Owner<\/strong><\/td><td>The named person accountable for closing it<\/td><\/tr>\n <tr><td><strong>Due date<\/strong><\/td><td>A realistic deadline for closure<\/td><\/tr>\n <\/table>\n\n <h2 class=\"sec\" id=\"scoring\">Scoring and prioritising gaps<\/h2>\n <p>Not every gap is equal, and you rarely have time to fix everything at once. Score each by how likely it is to produce an audit exception and how much real security risk it carries. That tells you what to fix first.<\/p>\n\n <div class=\"analogy\"><strong>A well-scored register does more than guide remediation.<\/strong> It gives you honest inputs for the decisions around the audit: a realistic timeline, a sensible Type I versus Type II call, and a clear picture of what standing between you and a clean report.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">Closing the gaps faster<\/h2>\n <p>Here is the pattern a SOC 2 gap analysis almost always reveals. A thorough SOC 2 gap analysis almost always finds the biggest gaps clustered in the same three places.<\/p>\n\n <div class=\"bigcards\">\n <div class=\"bigcard\"><div class=\"ic bc-navy\">CC6<\/div><h4>Access & MFA<\/h4><p>Access control and multi-factor authentication.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-indigo\">CC7<\/div><h4>Monitoring<\/h4><p>Monitoring and incident response.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-teal\">CC9<\/div><h4>Vendor risk<\/h4><p>Third-party and vendor risk management.<\/p><\/div>\n <\/div>\n\n <p>These are not documentation gaps you can write your way out of. They are missing or partial security controls that have to be built, run, and evidenced. That is where closing speed is won or lost. When security is scattered across a patchwork of point tools, every high-severity gap means procuring, configuring, and wiring up another product before you can even collect evidence.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">WITH OSTO, THOSE CONTROLS ARE ALREADY IN PLACE<\/div>The controls behind your highest-severity gaps, access, MFA, monitoring, and VAPT, are built into one platform, with the evidence collected from the same modules. Fewer gaps to close, and a shorter path from register to clean report.<\/div>\n\n <div class=\"callout\">\n <h3>Turn a daunting gap register into a clean report.<\/h3>\n <p>Osto is a one-stop cybersecurity and compliance platform for growing companies. The controls behind your highest-severity gaps come built in, with the evidence collected from the same platform, so you can get SOC 2 ready in about 115 days. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n\n <details>\n <summary>What is a SOC 2 gap analysis?<\/summary>\n <p>A structured comparison between your current security controls and the requirements of the SOC 2 Trust Services Criteria. For each in-scope criterion, you check whether you have a control, whether it is documented, and whether you can produce evidence, then list every gap.<\/p>\n <\/details>\n <details>\n <summary>How is it different from a readiness assessment?<\/summary>\n <p>A gap analysis is the diagnostic core: mapping your controls to the criteria and listing what is missing. A <a href=\"https:\/\/www.osto.one\/resources\/soc-2-readiness-assessment-checklist\">readiness assessment<\/a> is the broader phase that contains the gap analysis, plus remediation and a final self-check.<\/p>\n <\/details>\n <details>\n <summary>What is the difference between a gap and an exception?<\/summary>\n <p>A gap is a deficiency you find during your own readiness work, while there is still time to fix it privately. An exception is what the auditor documents when a control fails during formal testing, and it can appear in your final report.<\/p>\n <\/details>\n <details>\n <summary>When should I run a gap analysis?<\/summary>\n <p>Early, ideally three to six months before you want your observation window to open, and before you sign an engagement letter. Good triggers include an enterprise prospect asking for your report, or a mid-deal security questionnaire.<\/p>\n <\/details>\n <details>\n <summary>What is a gap register?<\/summary>\n <p>The concrete deliverable of a gap analysis: a control mapping matrix listing each criterion, your existing control, the gap status, its severity, the responsible owner, and a due date.<\/p>\n <\/details>\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SOC 2 Gap Analysis: How to Run One | Osto A SOC 2 gap analysis is the diagnostic step that\u2026<\/p>\n","protected":false},"author":8,"featured_media":578,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-577","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=577"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/577\/revisions"}],"predecessor-version":[{"id":579,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/577\/revisions\/579"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/578"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":577,"date":"2026-08-09T17:28:43","date_gmt":"2026-08-09T17:28:43","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=577"},"modified":"2026-08-09T17:28:43","modified_gmt":"2026-08-09T17:28:43","slug":"soc-2-gap-analysis","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/soc-2-gap-analysis\/","title":{"rendered":"SOC 2 Gap Analysis: How to Run One"},"content":{"rendered":"\n\n\n\n\n\nSOC 2 Gap Analysis: How to Run One | Osto<\/title>\n<meta name=\"description\" content=\"A clean, practical guide to running a SOC 2 gap analysis. What it is, how it differs from a readiness assessment, the step-by-step process, the gap register, scoring, and closing gaps faster.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .regtable{width:100%;border-collapse:collapse;margin:22px 0;font-size:13px;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .regtable th{background:#1c267a;color:#fff;text-align:left;padding:11px 14px;font-size:12px;letter-spacing:.03em}\n .regtable td{padding:10px 14px;border-bottom:1px solid var(--mist);color:var(--ink)}\n .regtable tr:last-child td{border-bottom:none}\n .regtable tr:nth-child(even) td{background:#fafbff}\n\n\n .procribbon{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0 6px;background:linear-gradient(135deg,#1c267a,#3a46c0);border-radius:14px;padding:16px 14px}\n .procribbon .pr{flex:1;min-width:90px;text-align:center;color:#fff;padding:4px 6px}\n .procribbon .pr .pn{font-size:11px;font-weight:800;opacity:.7}\n .procribbon .pr .pt{font-size:12.5px;font-weight:700;margin-top:2px;line-height:1.25}\n .procribbon .parr{color:rgba(255,255,255,.5);font-size:15px;font-weight:700;padding:0 2px}\n @media(max-width:640px){.procribbon{flex-direction:column;align-items:stretch}.procribbon .parr{display:none}.procribbon .pr{text-align:left;padding:6px 8px;border-bottom:1px solid rgba(255,255,255,.15)}}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}\n .bbox.indigo{border:2px solid #3a46c0}\n .bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n\n<div class=\"wrap\">\n <p class=\"dek\">A SOC 2 gap analysis is the diagnostic step that tells you exactly where you stand before an auditor does. Find the gaps while they are still easy to fix.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span>\n <span class=\"dot\"><\/span>\n <span>8 min read<\/span>\n <span class=\"dot\"><\/span>\n <span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A SOC 2 gap analysis measures the distance between the controls you have today and what the Trust Services Criteria require. It is the diagnostic you run first, so you find and fix problems while they are still private.<\/p>\n <p>The process: define scope, map each criterion to your controls, mark every gap, score it by severity, assign an owner and deadline, then remediate. The output is a gap register that drives everything downstream.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What it is<\/a><\/li>\n <li><a href=\"#vs\">Gap vs readiness<\/a><\/li>\n <li><a href=\"#exception\">Gap vs exception<\/a><\/li>\n <li><a href=\"#steps\">The 6 steps<\/a><\/li>\n <li><a href=\"#register\">The gap register<\/a><\/li>\n <li><a href=\"#scoring\">Scoring gaps<\/a><\/li>\n <li><a href=\"#osto\">Closing faster<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What a SOC 2 gap analysis is<\/h2>\n <p>A SOC 2 gap analysis is a structured comparison: your current controls on one side, the SOC 2 Trust Services Criteria on the other, and a clear list of the differences in between.<\/p>\n\n <div class=\"analogy\"><strong>Why it exists:<\/strong> most companies genuinely do not know where they stand. They have security practices, some formal, some informal, some documented, some living only in an engineer’s head. A gap analysis turns that fog into a concrete, prioritised list.<\/div>\n\n <h2 class=\"sec\" id=\"vs\">Gap analysis vs readiness assessment<\/h2>\n <p>These terms get used loosely, so here is the clean distinction.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">Gap analysis<\/div><div class=\"big\">The diagnostic core<\/div><div class=\"sm\">Mapping controls to criteria and listing what is missing. This is where the real intelligence comes from.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">Readiness assessment<\/div><div class=\"big\">The broader phase<\/div><div class=\"sm\">Contains the gap analysis, plus remediation and a final self-check. You run the gap analysis as its first and most important part.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"exception\">A gap is not an exception<\/h2>\n <p>This is the single most useful concept to hold onto, because it explains why the whole exercise is worth it.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k2\"><div class=\"lab\">A gap<\/div><div class=\"big\">Private, and fixable<\/div><div class=\"sm\">Found before or during your own readiness work, while there is still time to fix it quietly. A private to-do item.<\/div><\/div>\n <div class=\"k1\"><div class=\"lab\">An exception<\/div><div class=\"big\">Public, and costly<\/div><div class=\"sm\">What the auditor documents when a control fails during formal testing. It can land in your final report, where buyers read it, and delay certification.<\/div><\/div>\n <\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">THE ENTIRE POINT<\/div>a gap analysis converts would-be exceptions into gaps you have already closed. Every gap you find and fix now is an exception that never makes it into the report.<\/div>\n\n <h2 class=\"sec\" id=\"steps\">How to run one, step by step<\/h2>\n <p>Run your SOC 2 gap analysis before you sign an engagement letter, ideally three to six months before you want your observation window to open. It is a cross-functional exercise, not a one-person spreadsheet.<\/p>\n\n <div class=\"procribbon\">\n <div class=\"pr\"><div class=\"pn\">01<\/div><div class=\"pt\">Scope<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">02<\/div><div class=\"pt\">Map controls<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">03<\/div><div class=\"pt\">Flag gaps<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">04<\/div><div class=\"pt\">Score<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">05<\/div><div class=\"pt\">Assign owners<\/div><\/div>\n <div class=\"parr\">→<\/div>\n <div class=\"pr\"><div class=\"pn\">06<\/div><div class=\"pt\">Remediate<\/div><\/div>\n <\/div>\n\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Define scope<\/h4><\/div><ul><li>Which systems and data are in scope<\/li><li>Which criteria apply (Security is mandatory)<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Map controls to criteria<\/h4><\/div><ul><li>Go CC1 through CC9, plus any optional<\/li><li>Note the control that satisfies each, if any<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>Flag every gap<\/h4><\/div><ul><li>No control, undocumented, or no <a href=\"https:\/\/www.osto.one\/resources\/soc-2-evidence-collection\">evidence<\/a><\/li><li>Each of these counts as a gap<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Score by severity<\/h4><\/div><ul><li>How likely to cause an exception<\/li><li>How much real risk it carries<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">5<\/span><h4>Assign owners<\/h4><\/div><ul><li>A named owner with authority and resources<\/li><li>A realistic due date. Unowned gaps do not close<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">6<\/span><h4>Remediate & verify<\/h4><\/div><ul><li>Work the register, close each gap<\/li><li>A short internal re-test confirms readiness<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"register\">Building the gap register<\/h2>\n <p>The concrete deliverable is a gap register: a control mapping matrix that tracks each requirement, its status, and its path to closure.<\/p>\n\n <table class=\"regtable\">\n <tr><th>Column<\/th><th>What it captures<\/th><\/tr>\n <tr><td><strong>Criterion<\/strong><\/td><td>The SOC 2 requirement (CC1 through CC9, plus optional)<\/td><\/tr>\n <tr><td><strong>Existing control<\/strong><\/td><td>The control you have that satisfies it, if any<\/td><\/tr>\n <tr><td><strong>Gap status<\/strong><\/td><td>Met, partial, or missing<\/td><\/tr>\n <tr><td><strong>Severity<\/strong><\/td><td>How likely to cause an exception, and the risk it carries<\/td><\/tr>\n <tr><td><strong>Owner<\/strong><\/td><td>The named person accountable for closing it<\/td><\/tr>\n <tr><td><strong>Due date<\/strong><\/td><td>A realistic deadline for closure<\/td><\/tr>\n <\/table>\n\n <h2 class=\"sec\" id=\"scoring\">Scoring and prioritising gaps<\/h2>\n <p>Not every gap is equal, and you rarely have time to fix everything at once. Score each by how likely it is to produce an audit exception and how much real security risk it carries. That tells you what to fix first.<\/p>\n\n <div class=\"analogy\"><strong>A well-scored register does more than guide remediation.<\/strong> It gives you honest inputs for the decisions around the audit: a realistic timeline, a sensible Type I versus Type II call, and a clear picture of what standing between you and a clean report.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">Closing the gaps faster<\/h2>\n <p>Here is the pattern a SOC 2 gap analysis almost always reveals. A thorough SOC 2 gap analysis almost always finds the biggest gaps clustered in the same three places.<\/p>\n\n <div class=\"bigcards\">\n <div class=\"bigcard\"><div class=\"ic bc-navy\">CC6<\/div><h4>Access & MFA<\/h4><p>Access control and multi-factor authentication.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-indigo\">CC7<\/div><h4>Monitoring<\/h4><p>Monitoring and incident response.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-teal\">CC9<\/div><h4>Vendor risk<\/h4><p>Third-party and vendor risk management.<\/p><\/div>\n <\/div>\n\n <p>These are not documentation gaps you can write your way out of. They are missing or partial security controls that have to be built, run, and evidenced. That is where closing speed is won or lost. When security is scattered across a patchwork of point tools, every high-severity gap means procuring, configuring, and wiring up another product before you can even collect evidence.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">WITH OSTO, THOSE CONTROLS ARE ALREADY IN PLACE<\/div>The controls behind your highest-severity gaps, access, MFA, monitoring, and VAPT, are built into one platform, with the evidence collected from the same modules. Fewer gaps to close, and a shorter path from register to clean report.<\/div>\n\n <div class=\"callout\">\n <h3>Turn a daunting gap register into a clean report.<\/h3>\n <p>Osto is a one-stop cybersecurity and compliance platform for growing companies. The controls behind your highest-severity gaps come built in, with the evidence collected from the same platform, so you can get SOC 2 ready in about 115 days. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n\n <details>\n <summary>What is a SOC 2 gap analysis?<\/summary>\n <p>A structured comparison between your current security controls and the requirements of the SOC 2 Trust Services Criteria. For each in-scope criterion, you check whether you have a control, whether it is documented, and whether you can produce evidence, then list every gap.<\/p>\n <\/details>\n <details>\n <summary>How is it different from a readiness assessment?<\/summary>\n <p>A gap analysis is the diagnostic core: mapping your controls to the criteria and listing what is missing. A <a href=\"https:\/\/www.osto.one\/resources\/soc-2-readiness-assessment-checklist\">readiness assessment<\/a> is the broader phase that contains the gap analysis, plus remediation and a final self-check.<\/p>\n <\/details>\n <details>\n <summary>What is the difference between a gap and an exception?<\/summary>\n <p>A gap is a deficiency you find during your own readiness work, while there is still time to fix it privately. An exception is what the auditor documents when a control fails during formal testing, and it can appear in your final report.<\/p>\n <\/details>\n <details>\n <summary>When should I run a gap analysis?<\/summary>\n <p>Early, ideally three to six months before you want your observation window to open, and before you sign an engagement letter. Good triggers include an enterprise prospect asking for your report, or a mid-deal security questionnaire.<\/p>\n <\/details>\n <details>\n <summary>What is a gap register?<\/summary>\n <p>The concrete deliverable of a gap analysis: a control mapping matrix listing each criterion, your existing control, the gap status, its severity, the responsible owner, and a due date.<\/p>\n <\/details>\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SOC 2 Gap Analysis: How to Run One | Osto A SOC 2 gap analysis is the diagnostic step that\u2026<\/p>\n","protected":false},"author":8,"featured_media":578,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-577","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=577"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/577\/revisions"}],"predecessor-version":[{"id":579,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/577\/revisions\/579"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/578"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}