A quantitative methodology for information security control gap analysis

From information security point of view, an enterprise is considered as a collection of assets and their interrelationships. These assets contain vulnerabilities, which may be exploited by threats to breach information security aspects of enterprises. In order to prevent this, security controls need to be implemented. It is important to analyze the gaps that exist in the implementation of controls in an enterprise. The present study proposes such a control gap analysis methodology.