Free tool · Compliance gap map
Turn your identity gaps into a plan you can hand to a sponsor.
Tell it what is true today and which rules you answer to. It returns a gap register sorted by your obligations: each gap names the controls it touches, the template that closes it, and when to tackle it. For a quick read on where you are drifting, use the Predictability Assessment instead.
From The Modern Identity Operating Model by Becky Sandberg. Grounded in the book's Appendix D control crosswalk.
1. What is in scope?
This decides which gaps apply to you. A workforce-only program will not see customer-privacy items.
2. Which frameworks and regulations do you answer to?
Check every one that binds you, wherever your organization and your users sit. These drive the result: they reorder the register by what you must comply with, and surface gaps you did not flag but a rule still reaches.
3. Which of these are true today?
Check every one that is honestly true. Be candid; a blank you should have checked is exactly what step two is built to catch.
Illustrative example of one register entry
Gap: No recurring access review for a high-risk system. Touches: access review / certification controls. Closes with: the Access Model Template, with a named reviewer and a recurring cadence. Order: early wave, because a framework you selected reaches it.