Skip to content
ENExplore Calculators

Control Gap Calculator

Size a control gap against any framework: weighted gap, coverage, maturity shortfall and the effort and cost to close it.

About Control Gap Calculator

Planned controls still carry 80% of the work because a funded date is not an implementation, and partial controls carry half — enough to recognise progress, not enough to claim coverage. The maturity shortfall inflates effort rather than the gap itself, since raising a control from defined to measured is real work that does not change how many controls exist. Gap counts get quoted to steering committees without an effort figure attached, which is how a two-hundred-day programme gets approved as an action item. Both numbers are management estimates from your own inputs, not a scoped delivery plan.

Formulas

Control Gap

Weighted gap = 0.5 × partial + 0.8 × planned + 1.0 × missing, expressed as a share of applicable controls; effective coverage = (implemented + 0.5 × partial) ÷ applicable.

applicable
Framework controls minus justified exclusions
0.5 / 0.8 / 1.0
Remaining work weights for partial, planned and missing controls
weightedGap
Gap expressed in whole-control equivalents

Effort and cost

Effort = weighted gap × days per control × (1 + 0.15 × maturity shortfall); cost = effort days × cost per day derived from your cost and effort per control.

maturity shortfall
Levels between current and target maturity, each adding 15% effort
effortDays
Person-days, not elapsed days

Worked example

With the default values below, Control Gap Calculator returns Weighted Control Gap of 23.2%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Controls in the frameworkaccepts 1–5,000 controls
93 controls
Fully implemented and evidencedaccepts 0–5,000 controls
58 controls
Partially implementedaccepts 0–5,000 controls
14 controls
Planned with a funded dateaccepts 0–5,000 controls
9 controls
Not applicable, with justificationaccepts 0–5,000 controls
6 controls
Current maturity of implemented controlsone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
3 — Defined
Target maturityone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
4 — Measured
Average effort to implement one controlaccepts 0.5–200 days
4 days
Average cost to implement one controlaccepts 0–10,000,000 $
3,500 $

Results

Weighted Control Gap
23.2%
Effective Coverage
74.7%
Controls Not Fully Implemented
29 controls
Weighted Gap in Control Equivalents
20.2 controls
Controls With Nothing in Place
6 controls
Effort to Close
93 person-days
Estimated Cost to Close
$81,375
Maturity Shortfall
1 levels
Where to Start
Start with the 6 control(s) that have nothing in place — they carry the full gap weight and the most risk
Gap Verdict
Material gap — this needs a funded programme rather than best effort alongside day jobs

Step by step

  1. 1Values used
  2. 2Control Gap
  3. 3Effort and cost
  4. 4Weighted Control Gap= 23.2
  5. 5Effective Coverage= 74.7
  6. 6Controls Not Fully Implemented= 29 controls
  7. 7Weighted Gap in Control Equivalents= 20.2 controls
  8. 8Controls With Nothing in Place= 6 controls
  9. 9Effort to Close= 93 person-days

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Control Gap calculated?

Weighted gap = 0.5 × partial + 0.8 × planned + 1.0 × missing, expressed as a share of applicable controls; effective coverage = (implemented + 0.5 × partial) ÷ applicable. Planned controls still carry 80% of the work because a funded date is not an implementation, and partial controls carry half — enough to recognise progress, not enough to claim coverage. The maturity shortfall inflates effort rather than the gap itself, since raising a control from defined to measured is real work that does not change how many controls exist.

Why does Control Gap matter?

Gap counts get quoted to steering committees without an effort figure attached, which is how a two-hundred-day programme gets approved as an action item. Both numbers are management estimates from your own inputs, not a scoped delivery plan.

What values do I need to enter?

This calculator takes 9 inputs: Controls in the framework, Fully implemented and evidenced, Partially implemented, Planned with a funded date, Not applicable, with justification, Current maturity of implemented controls, Target maturity, Average effort to implement one control, Average cost to implement one control. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why do planned controls count as a gap at all?

Because a plan is not a control. Until it operates and produces evidence, the risk is unmitigated, and anyone relying on the framework percentage is relying on a forecast. Counting planned work at 80% acknowledges the funding and the date without pretending the control exists.

Is the effort estimate reliable?

It is a planning bracket, not a quote. Days per control varies by an order of magnitude between writing a policy and deploying a technical control across an estate, so run it with two values — a cheap one and a realistic one — and use the spread in the funding conversation.

Related Calculators

Control Gap Calculator – Calculate Weighted Control Gap