What process compares current security posture to the desired posture?

What process compares current security posture to the desired posture?

• A. Due Diligence
• B. Gap Analysis
• C. Policies
• D. Due Care

Answer: (B)

Determining how far the current security posture is from the target posture is done through a gap analysis. This process systematically compares what you have in place now—controls, procedures, and risk exposure—with the desired state defined by standards, policies, or a risk model. The result highlights gaps where controls are missing or insufficient and specifies what needs to be added or changed to reach the target posture. This guides remediation and prioritization, such as implementing new access controls, updating configurations, or adopting additional security measures.

Why the other options don’t fit: due diligence focuses on evaluating a person, asset, or deal before a decision, not on measuring security gaps; due care is the legal obligation to protect, not a comparative assessment; policies describe the desired rules and controls but do not themselves perform the comparison or identify gaps.