Gap analysis: how compliant you really are
A self-assessment across 13 standards, with a score that tells "we do it" apart from "we can prove it". And a simulation that shows where you would get to before you invest.
Why yes/no checklists do not survive an audit
Tick-box self-assessments produce reassuring numbers that fall apart at the auditor's first question: "can you show me?". A control applied on half the computers, or applied everywhere but with no written procedure, counts in a yes/no checklist as much as one that is documented and verified. It is not the same thing, and the assessor knows it.
The Dottor Box gap analysis was designed so that you do not fool yourself. It measures the distance between your situation and the requirements of a standard, requirement by requirement, and expresses it as a percentage index that you can compare over time and across different standards.
It is the starting point of every compliance programme: NIS2, GDPR, ISO 27001, DORA, the CIS Controls and the other standards available in the platform.
Two dimensions for every requirement: coverage and maturity
For each requirement you do not answer once, but twice. How widely the control is applied across the organisation, and how far it is formalised and measured.
Coverage
How widely the control is applied: across the whole company, at some sites or departments, on a few systems or on none. It is the question "do we do it, and where?".
Maturity
How far the control is formalised, documented and measured, on five levels. It is the question "can we prove it?".
The score is a weighted average: coverage counts for 75%, maturity for 25%. Doing counts for more than writing, but an undocumented control is not worth as much as one that is documented and verifiable. That is the difference an auditor measures, and the score makes it visible before the auditor arrives.
The score read through the Italian National Cybersecurity Framework
Every score, whatever the standard, is broken down into the five functions of the Framework Nazionale per la Cybersecurity, Italy's National Cybersecurity Framework, which is built on the NIST Cybersecurity Framework.
Identify
Knowing what you have to protect: assets, data, suppliers, risks and responsibilities.
Protect
Access, secure configurations, training, backups and data protection.
Detect
Noticing an anomaly or an attack under way in time.
Respond
Handling the incident: containing it, communicating it, notifying it on time.
Recover
Getting back to work and learning from what happened.
Many companies protect well and detect nothing. With the score by function you see it straight away, and you know where to invest first.
"If I activate these services, where do I get to?"
Before deciding what to spend on, you can ask the platform. Choose one or more Dottor Box services: the requirements those services cover are raised to the maximum and the score is recalculated, standard by standard and function by function.
So the gap analysis is not just a snapshot of where you are, but a planning tool: you see how much your NIS2 index would rise if you activated supplier qualification, or how much a training programme with its record would count towards ISO 27001.
The result is a simulation, not a promise: it shows the contribution of each service to the requirements, while the real score remains the one you declare and can demonstrate.
- Choose the services to simulate, including several at once
- The requirements covered rise to the maximum, the others stay unchanged
- See the new overall score and the score by function
- Compare the effect of the same choice on different standards
A self-assessment that stays valid over time
Versioned catalogue
Answers are tied to the version of the standard. When a framework is updated, the history of your assessments stays readable and is not rewritten after the fact.
Comparison across standards
The dashboard shows, for each standard, the version, the number of requirements, the answers given and the scores. Find out how much of the work done for one also counts for another.
From the gap to the evidence
The self-assessment measures; the Compliance and GRC module produces procedures, evidence, audits and the Statement of Applicability (SoA) to close the gap.
Dottor Box is a self-assessment tool that supports your compliance work: it measures, organises and documents. Certifications are issued by accredited bodies, and the assessment of compliance remains the responsibility of your organisation and of the competent authorities.
13 standards and frameworks, the same method
European laws, certifiable international standards and good-practice frameworks: each one has its own page with the requirements, who it applies to and the modules that cover them.
NIS2 · essential entities
Proactive supervision and higher fines: from the gap to the evidence.
Learn more ComplianceNIS2 · important entities
Security measures, incidents and suppliers for important entities.
Learn more ComplianceGDPR
Records of processing, appointments, Article 32 measures and data breaches.
Learn more ComplianceISO/IEC 27001
The information security management system, from the SoA to the audit.
Learn more ComplianceISO/IEC 27017
Security controls specific to cloud services.
Learn more ComplianceISO/IEC 27018
Protection of personal data in the public cloud.
Learn more ComplianceNIST Cybersecurity Framework 2.0
The six functions of the US framework, including the new Govern.
Learn more ComplianceDORA · Digital Operational Resilience Act
Digital operational resilience for the financial sector and its ICT providers.
Learn more ComplianceSOC 2
The Trust Services Criteria that US software and cloud customers ask for.
Learn more ComplianceCIS Controls · IG1
Basic cyber hygiene: the starting point for every SME.
Learn more ComplianceCIS Controls · IG2
The level for organisations handling sensitive data across several sites or IT teams.
Learn more ComplianceCIS Controls · IG3
The full level for organisations with dedicated security experts.
Learn more ComplianceCLUSIT framework
The reference framework of the Italian Information Security Association.
Learn moreCompliance gap analysis: the most common questions
What is a compliance gap analysis?
It is the measure of the distance between how your organisation works today and what a standard requires. In Dottor Box it is expressed as a percentage index per standard and per security function, calculated on the coverage and maturity of each requirement.
Does Dottor Box issue a certification?
No. The platform helps you understand where you are, build the management system and collect the evidence. Certification, where it exists, is issued by an accredited certification body after its own audit.
Can I assess several standards together?
Yes. The standards active on your contract appear first in the dashboard, and the scores are comparable because they use the same method and the same five functions.
Which standard is it best to start from?
If you have an obligation, start with that one: NIS2, GDPR or DORA. If you do not, NIST CSF 2.0 or the CIS Controls IG1 are the most useful starting point for working out where to begin.
Where the gap analysis turns into work done
Compliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernRisk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more ProveCompliance documents
SoA, management review minutes, evidence files, audit reports and registers.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.