Use when measuring the distance between where your security is and where it needs to be — against a framework, a target state, or a requirement — and turning the gaps into a prioritised roadmap.
