A method of assessing the differences between an organization's current security posture and the desired state as defined by industry standards, frameworks, or regulatory requirements.