Compliance Gap Score Calculator
Work out compliance gap score instantly with clear inputs, formula shown and shareable results.
About Compliance Gap Score Calculator
A gap assessment counts requirements at three implementation states, and giving partial implementations half credit avoids both the optimism of counting them as done and the pessimism of counting them as absent. Multiplying the remaining work by an average effort per gap converts the percentage into a schedule, which is what determines whether an audit date is realistic.
Formula
Compliance and effort
compliance = (full + 0.5 x partial) / total; effort = (not implemented + 0.5 x partial) x days per gap
Worked example
With the default values below, Compliance Gap Score Calculator returns Weighted compliance of 73.7%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Requirements in the frameworkminimum 1
- 114
- Fully implementedminimum 0
- 72
- Partially implementedminimum 0
- 24
- Effort per remaining gapminimum 0.1 days
- 4 days
Results
- Weighted compliance
- 73.7%
- Requirements not implemented at all
- 18
- Effort to close the gaps
- 120.0 days
- Audit readiness
- Substantial work remaining
Step by step
- 1Values used
- 2Compliance and effort
- 3Weighted compliance= 73.7
- 4Requirements not implemented at all= 18
- 5Effort to close the gaps= 120.0 days
- 6Audit readiness= Substantial work remaining
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Do all requirements carry equal weight?
No. Certification usually hinges on a subset of mandatory clauses, so a weighted assessment that reflects auditor emphasis is more predictive than a flat count.
Is documentation enough to count a requirement as implemented?
No. Auditors test evidence of operation over a period, so a written policy with no records of execution will be assessed as partial at best.
Related Calculators
- Control Effectiveness Score Calculator
- CVSS Base Score Calculator
- CVSS Environmental Score Calculator
- CVSS Temporal Score Calculator
- Insider Threat Risk Score Calculator
- Least Privilege Score Calculator
- Log Retention For Compliance Calculator
- Patch SLA Compliance Calculator
- Security Maturity Score Calculator
- Access Review Effort Calculator
You might also need
- Security Maturity Score CalculatorAlso in Security, Cryptography & Risk
- Control Effectiveness Score CalculatorAlso in Security, Cryptography & Risk
- CVSS Base Score CalculatorAlso in Security, Cryptography & Risk
- CVSS Environmental Score CalculatorAlso in Security, Cryptography & Risk
- CVSS Temporal Score CalculatorAlso in Security, Cryptography & Risk
- Least Privilege Score CalculatorAlso in Security, Cryptography & Risk
