Gap assessment workbook: build once, map many

Template · Excel (.xlsx) · Free, no email required · Reviewed June 2026

One honest self-assessment that answers most of what SOC 2 questionnaires, ISO gap analyses, cyber insurers, and customer security reviews will ever ask you. That's the premise, and it works because the frameworks overlap far more than anyone selling framework-specific projects admits.

What's inside

• All 56 safeguards of CIS Controls v8.1, Implementation Group 1 — the set CIS defines as essential cyber hygiene, deliberately scoped for organizations without a security team. Each safeguard gets four columns of plain talk: what it means, why it matters at small scale, how to realistically implement it (tools-agnostic where possible, M365/Windows-specific where useful), and what evidence typically satisfies an assessor.
• Editorial mappings to NIST CSF 2.0 and ISO/IEC 27001:2022 Annex A for every safeguard — so you can translate your work into other frameworks' language for questionnaires and gap conversations. (They're guidance, not official crosswalks; the Read Me is explicit about when you need the official documents.)
• A self-calculating dashboard — overall and per-control implementation percentages. The "% implemented" figure is a number leadership can track quarter over quarter, which makes it the rare security metric executives actually remember.

The one rule that makes it honest

Be ruthless about the difference between Implemented and Partial. If you can't point to an artifact — an export, a dated screenshot, a review sign-off — it's Partial at best. A control without evidence doesn't exist in an audit, and pretending in your own workbook only means the audit discovers it instead of you.

How to use it

Work top to bottom, set a status for each safeguard, and let the dashboard do the math. Reassess twice a year — the delta between assessments is your security program's progress report, and it writes itself. Where a safeguard fights your reality, record the deviation and reasoning in Notes: assessors respect documented judgment far more than silent gaps.

Background reading: The framework maze, decoded explains why CIS IG1 is the right spine and the others are reporting formats. The M365-specific items map closely to the M365 baseline.