Control Gap Calculator

Weighted gap = 0.5 × partial + 0.8 × planned + 1.0 × missing, expressed as a share of applicable controls; effective coverage = (implemented + 0.5 × partial) ÷ applicable. Planned controls still carry 80% of the work because a funded date is not an implementation, and partial controls carry half — enough to recognise progress, not enough to claim coverage. The maturity shortfall inflates effort rather than the gap itself, since raising a control from defined to measured is real work that does not change how many controls exist.

Gap counts get quoted to steering committees without an effort figure attached, which is how a two-hundred-day programme gets approved as an action item. Both numbers are management estimates from your own inputs, not a scoped delivery plan.

This calculator takes 9 inputs: Controls in the framework, Fully implemented and evidenced, Partially implemented, Planned with a funded date, Not applicable, with justification, Current maturity of implemented controls, Target maturity, Average effort to implement one control, Average cost to implement one control. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because a plan is not a control. Until it operates and produces evidence, the risk is unmitigated, and anyone relying on the framework percentage is relying on a forecast. Counting planned work at 80% acknowledges the funding and the date without pretending the control exists.

It is a planning bracket, not a quote. Days per control varies by an order of magnitude between writing a policy and deploying a technical control across an estate, so run it with two values — a cheap one and a realistic one — and use the spread in the funding conversation.