An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected. You measure it in 2 units: the controls in scope that lack a current passing result, and the days each of them spends in that state. Evidence counts as current while it is younger than the assessment frequency the organization set for the control, so the measure starts from a schedule the organization already owns.
The gap is the distance between what an organization believes about its controls and what its evidence can show today. It rarely opens with an incident. A control passes its test, the evidence starts to age, a connector loses access or a new system arrives outside every test, and the dashboard goes on showing the last good result. Nothing changes color when that happens, which is why the gap has to be counted on purpose.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA, and a CCA program exists to keep the assurance gap small, visible and owned. This article explains what counts as current evidence, what causes gaps in mature programs, how to measure one, how design and operating effectiveness relate to it, why stale evidence misleads, and how to report the gap to executives.
How do internal and external auditors see the same gap?
Internal auditors meet the gap at the level of risks. The Institute of Internal Auditors (IIA), in its executive knowledge brief on combined assurance of February 2022, recommends an assurance map: an overview of the key risk areas and of who provides monitoring over each one, which “examines any gaps and overlaps in coverage.” A risk with no assurance provider on the map is a risk whose controls nobody holds current evidence for.
External auditors meet the time side of it. The PCAOB’s standard for audits of internal control over financial reporting, AS 2201, covers the case of an auditor who tests controls at an interim date and reports on a later one. Paragraph .55 asks that auditor to decide what additional evidence covers the remaining period, and the standard calls this work roll-forward procedures. The time between the test and the report date is an assurance gap, and the auditor closes it with evidence.
The definition on this page works one level below both views, at the control. That is where the gap can be counted, given an owner and closed.
What counts as current evidence?
Evidence is current when 3 things are true. It came from the system that enforces the control, or from the signed record where no system enforces it. It covers every item in the control’s scope. It is younger than the window the organization set for that control. NIST control CA-7 in SP 800-53 Revision 5 asks an organization to establish its own frequencies for monitoring and, separately, for assessing control effectiveness. That assessment frequency is the window. A control assessed daily has evidence that is current for a day, and a quarterly access review has evidence that stays current until the next review falls due.
NIST explains why age matters. Its assessment guide, SP 800-53A Revision 5, says that “as the time between current and previous assessments increases, the credibility and utility of the previous assessment results decrease,” since the system and its environment become more likely to have changed. The same section warns that controls “deemed effective during previous assessments may have become ineffective due to changing conditions.” In SP 800-53, the discussion of control CA-2 asks organizations to ensure that assessment results are current and relevant to the determination of control effectiveness.
At any moment, every control in scope sits in 1 of 3 states. It has current evidence that it passes, it has current evidence that it fails, or it has no current evidence either way. The assurance gap holds the second and third groups. Known failures should already have an owner and a finding, while the unknowns are the part a green dashboard hides, so the two are reported separately. The difference between a control failure and an evidence failure is set out in How Do You Know Whether Security Controls Are Actually Working?
What causes assurance gaps in mature compliance programs?
Mature programs have policies, owners and audits. Their gaps open between tests, in places an annual cycle was never built to watch, and these are the causes to look for.
- Test frequencies trail the rate of change. NIST SP 800-137 says monitoring frequencies “are not static, and they are not uniform across all metrics.” A program that tests a cloud configuration on the same annual cycle as a signed policy leaves the configuration unproven for most of the year.
- Scope drifts. A new cloud account, SaaS application or subsidiary joins the environment, and every control tested against the old inventory is untested for it. CIS Control 1 asks an enterprise to “accurately know the totality of assets that need to be monitored and protected within the enterprise.”
- Evidence feeds fail quietly. A connector loses its permission after a credential rotation, an agent stops reporting or an export covers part of the population, and the last result stays on screen.
- Old results are reused past their window. A prior assessment, last year’s audit sample or a supplier’s report for an earlier period gets read as if it described today. SP 800-53A asks for the date and type of the original assessment to be documented whenever a result is reused, which keeps its age in view.
- Changes trigger no retest. NIST control enhancement CA-7(4) makes change monitoring part of risk monitoring, and a change that no test hears about leaves the old pass standing.
- Findings close on a promise. A ticket marked fixed without a passing retest moves a control from known failure to unknown, while the report shows it as closed.
- Assurance is split across teams. Security, compliance, risk and internal audit each keep their own evidence and calendars, and nobody sees the controls that fall between them. The IIA’s assurance map exists to find that problem.
How do you measure an assurance gap?
The method below works in a spreadsheet or in a platform. For each control it needs 4 inputs: the control’s scope, its assessment frequency, the time of its latest result and what that result was.
- List the controls in scope and, for each one, the items it has to cover, such as accounts, servers or suppliers, taken from the asset inventory.
- Record the window for each control, which is the assessment frequency the organization set for it under CA-7.
- Record the latest result for each control, the time its evidence was read and whether that evidence covered every item in scope.
- Give each control one state: current pass, current fail, stale, missing, never tested or out of scope. Stale means the latest evidence is older than the window, missing means the last attempt to read the evidence failed, and out of scope means items exist that no test reads.
- Count the gap by controls. Every control that is not a current pass belongs in it, and the known failures and the unknowns are reported as 2 separate numbers, grouped by the risk tier of each control.
- Count the gap by time. For each control, add up the days it spent without a current pass during the period, from the moment its window expired or its test failed to the moment a passing result on current evidence came back.
The program then has 2 summary figures. The gap share by controls is the number of in-scope controls without a current pass divided by the number of in-scope controls. The gap share by time is the total of those days across all controls, divided by the number of in-scope controls multiplied by the days in the period. The share by controls says how much of the program is unproven today, and the share by time says how much of the period went unproven.
Read both by risk tier as well, since a gap on a control that treats a critical risk can matter more than several gaps on low-risk controls. A control leaves the gap when a passing result on current evidence comes back, and a closed ticket does not change that. The measure can be no more honest than the inventory under it. A control whose scope misses a new system looks current while that system sits outside every test, which is why step 1 starts from the inventory.
Which metrics should a Continuous Control Assurance (CCA) program track?
A Continuous Control Assurance program needs a small set of measures, and they say more when they are read together. NIST’s measurement guide, SP 800-55 Volume 1, published in December 2024, sorts measures into 4 types: implementation, effectiveness, efficiency and impact. The table sets out the measures that surround the assurance gap and the standard each one comes from.
| Measure | What it answers | How to calculate it | Where it comes from |
|---|---|---|---|
| Control coverage | It answers whether every in-scope control has an expected state, an evidence source and a test. | Divide the controls that have all 3 by the controls in scope. | NIST SP 800-55 Volume 1 treats percentages of this kind as implementation measures. |
| Population coverage | It answers whether each test reads every item it should. | Divide the items a test read by the items the inventory holds for that control’s scope. | CIS Control 1 asks an enterprise to know the totality of its assets. |
| Evidence currency | It answers whether the evidence is recent enough to rely on. | Divide the controls whose latest result falls inside their window by the controls in scope. | NIST SP 800-53 control CA-7 has the organization set the window, and the discussion of CA-2 asks for current results. |
| Assurance gap by controls | It answers which controls have no current evidence that they pass right now. | List and count the in-scope controls without a current pass, with known failures and unknowns kept apart. | NIST SP 800-53A section 3.2.3.5 explains why older results lose credibility. |
| Assurance gap by time | It answers how long controls went without current evidence during the period. | Divide the days controls spent in the gap by the controls in scope multiplied by the days in the period, and name the oldest open gap. | PCAOB AS 2201 paragraph .55 treats the time after a test as a period that needs its own evidence. |
| Control reliability | It answers how consistently a control holds its expected state. | Divide the passing runs by the runs that reached a decision in the period, and report the undecided runs beside the result. | PCAOB AS 2201 paragraph .44 defines the test of whether a control is operating as designed. |
| Control efficacy | It answers whether the control produces the outcome it exists for. | Test outcome evidence against the control objective, such as sign-in records that show every administrator session completing a second factor. | NIST SP 800-53 control CA-2 includes producing the desired outcome in control effectiveness. |
| Time to close | It answers how quickly a gap is closed once it is found. | Measure the time from a failed or undecided result to a named owner, and from that owner to a passing retest. | NIST SP 800-55 Volume 1 counts how quickly issues are addressed as an efficiency measure. |
Coverage, reliability and efficacy answer different questions, and a program needs all 3. Coverage says whether the test looks everywhere it should. Reliability says whether the control held its expected state each time the test looked. Efficacy goes one step further and asks whether that expected state produces the result the control exists for, which is the third part of the NIST definition of control effectiveness in CA-2: implemented correctly, operating as intended and producing the desired outcome.
None of the standards cited on this page sets a target for these measures, and DigitalXForce publishes none. Track each one from the month the program starts, and report the trend.
How do design effectiveness and operating effectiveness relate to the assurance gap?
Auditors test a control in 2 ways. PCAOB AS 2201 describes testing design effectiveness as determining whether the company’s controls, operated as prescribed by people with the necessary authority and competence, satisfy its control objectives (paragraph .42). Testing operating effectiveness means determining “whether the control is operating as designed” (paragraph .44). The standard is written for financial reporting, and the 2 ideas carry over to security and compliance controls.
In its everyday form, the assurance gap is an operating effectiveness gap. Operating evidence ages on the control’s own schedule, and a test can refresh it as often as the system allows. Design keeps a different clock. A control can pass every test and still rest on a design that no longer fits the risk, for example when an access rule written for employees now also governs service accounts and AI agents. A current pass then proves that the control matches an expected state nobody has checked against the new risk.
Measure the design side separately, beside the assurance gap. Give each control a design review date, and list it as overdue when that review falls due or when the risk or the requirement behind it changes. A current pass on a control with an overdue design review should carry that flag in every report. The Continuous Control Assurance page explains why design stays a human judgment while operating effectiveness is where automation does most of the work.
How does stale evidence create a false sense of assurance?
Stale evidence misleads because the display does not age with it. A dashboard tile shows the last result it received, and when the feed behind it stops, the tile keeps its color. The control looks current while its evidence grows older every day.
Roll-ups make it worse. NIST SP 800-137 notes that metrics “may use security-related information acquired at different frequencies and therefore with varying data latencies.” A single compliance percentage built from yesterday’s configuration reads and last year’s access review looks like one fact, when it is several facts of very different ages. Auditors work to the same principle. PCAOB AS 2201 says that “testing performed closer to the date of management’s assessment provides more evidence than testing performed earlier in the year” (paragraph .52).
The fix is a display rule that any program can adopt.
- Every result shows the time its evidence was read.
- A result older than its window is shown as undecided and enters the gap, and it is never counted as a pass.
- Every roll-up reports current passes, known failures and unknowns as 3 separate numbers, and it names the oldest open gap.
Evidence collection and control validation are different jobs, and Evidence Collection vs Control Validation explains where one stops and the other starts. How Automated Control Testing Decides Whether a Control Still Works sets out the pass, fail and undecided results in full.
How should the assurance gap be reported to executives?
Executives need the gap for the controls behind their largest risks, in a form that leads to a decision. NIST control CA-7 asks for the security and privacy status of each system to be reported to roles, and at a frequency, that the organization defines. NIST SP 800-55 Volume 1 lists what a measurement report could carry so that it is read in context: any risk the measure indicates, whether the findings fit the organization’s risk appetite, what prioritization, action or decision may be needed, any compliance issues, and the impact on being audit-ready.
For the assurance gap, that becomes a short view.
- The view shows, for the controls behind each top risk, how many have current passing evidence, how many failed and have an owner, and how many are unknown and why.
- It shows the gap share by time since the last meeting, and which way it moved.
- It names the oldest open gaps, each with an owner and a date.
- It lists the decisions executives need to make, such as accepting a gap until a stated expiry date, funding a fix or restoring an evidence source.
Every number in the view should open onto the controls and the evidence beneath it, so a director can check any figure. A compliance percentage cannot stand in for this view, and Compliance Status vs Control Effectiveness explains why the two drift apart. DigitalXForce’s board metrics and report generator turns control and risk data into the few indicators a board tracks, with the trend and the reason behind each one.
An illustration: measuring the gap in one control family
This example is an illustration. The organization is invented, and the example uses no figures.
A regional bank runs its identity controls under Continuous Control Assurance. Multifactor authentication for administrators and the removal of leavers’ accounts are read daily from the identity provider and the HR system. The privileged access review is a quarterly control with a signed record.
One week, the identity team rotates the credential the connector uses, and the connector loses its read permission. The next daily reads of both identity controls return undecided. An ordinary dashboard would have kept both tiles green. Under the program’s rule, both controls enter the unknown part of the gap at the moment their windows expire, and the missing feed goes to the owner of the identity platform. In the same week, the quarterly access review passes its due date without a signed record, so it enters the gap on that date. A subsidiary that joined the bank last month still runs its own directory, which no identity test reads yet, so every identity control carries the out of scope state until the inventory check adds those accounts.
The gap report for the week lists each control with its state, the reason, the moment it entered the gap and its owner. For each control, the gap by time counts the days from the moment it entered the gap to its next passing result. Once the connector is restored, the next read shows multifactor authentication passing, and the leaver control fails on an account that is still active. That control moves from unknown to known failure, gets a finding with an owner and leaves the gap on a passing retest after the account is removed. The access review leaves the gap when its signed record arrives, and the subsidiary’s directory enters the tests once the inventory includes it.
How DigitalXForce keeps the gap visible
DigitalXForce records every result with the time its evidence was read, and its compliance dashboards show evidence age, as the Continuous Control Monitoring page describes. Stale or missing evidence is recorded as stale or missing instead of counting as a pass, which is the display rule above, and the Continuous Control Assurance page explains how evidence is kept trustworthy. The FAQ answer on how controls are validated walks through the cycle from exception to revalidation.
The AI-Powered Risk Management and Automated GRC module holds the control library and maps each control once to 50+ compliance frameworks, so one result answers every framework that requires the control. DigitalXForce’s Attack Surface Manager runs agentless, API-based discovery and inventory across 9 asset classes, IT and OT, which keeps the out of scope state honest.
For executives, KPI and KRI Management builds a configurable indicator matrix by business domain, risk category and risk type, with thresholds and Level 1 and Level 2 posture tracking, and each indicator is approved before it is published. The glossary entry for KPI and KRI Management describes the module. XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant. Analysts review what the AI produces before anyone relies on it.
Where DigitalXForce is not the answer
A startup or small company preparing its first SOC 2 report can start with DigitalXForce Lite, which runs the same platform in the cloud with the same functionality and a faster deployment. A program with a short list of controls can run the measure on this page in a spreadsheet, as long as every result carries the time its evidence was read.
Questions about the assurance gap and Continuous Control Assurance (CCA)
What is an assurance gap?
An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected. It includes controls whose current evidence shows a failure and controls with no current evidence either way, such as stale, missing, untested or out of scope controls. The second group is the part a green dashboard hides.
How is an assurance gap measured in Continuous Control Assurance (CCA)?
Measure it in controls and in time. Count the in-scope controls without a current passing result, with known failures and unknowns kept apart, and add up the days each control spent without one during the period. Evidence is current while it is younger than the assessment frequency the organization set for the control.
What causes assurance gaps in mature compliance programs?
The common causes are test frequencies slower than the rate of change, new assets outside every test, evidence feeds that fail without anyone noticing, and old results reused past their window. Changes that trigger no retest, findings closed without a retest and assurance split across teams add to the gap. Each one leaves a control looking current after its evidence has stopped being current.
What metrics should a Continuous Control Assurance (CCA) program track?
Track control coverage, population coverage, evidence currency, the assurance gap by controls and by time, control reliability, control efficacy and the time to close a gap. None of the standards cited on this page sets a target for any of them, so report each as a trend and let every number open onto the evidence behind it.
How do you measure control coverage, control reliability and control efficacy?
Control coverage is the share of in-scope controls with an expected state, an evidence source and a test, and population coverage is the share of inventory items each test reads. Control reliability is the share of decided test runs in which the control held its expected state, with undecided runs reported beside it. Control efficacy tests outcome evidence, such as sign-in records or completed restores, against the objective the control exists for.
Does Continuous Control Monitoring (CCM) close an assurance gap on its own?
It does not. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. That keeps evidence current and shrinks the unknown part of the gap. A control leaves the gap when a test in Continuous Control Assurance (CCA) compares that evidence with the expected state and records a pass.
How should an assurance gap be reported to executives?
Report it for the controls behind the top risks, showing how many have current passing evidence, how many failed and have an owner, and how many are unknown and why. Add the trend since the last meeting, the oldest open gaps with their owners and the decisions executives need to make. Every number should open onto the evidence behind it.
Sources
- NIST published SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, in September 2011, at https://csrc.nist.gov/pubs/sp/800/137/final. The passage on monitoring frequencies is in section 2.2, and the passage on data latencies is in section 3.2.1.
- NIST published SP 800-53A Revision 5, Assessing Security and Privacy Controls in Information Systems and Organizations, in January 2022, at https://csrc.nist.gov/pubs/sp/800/53/a/r5/final. The passages on reusing earlier results and on the time since an assessment are in section 3.2.3.5.
- NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, sets out controls CA-2 and CA-7 and the enhancement CA-7(4), which were read from NIST’s catalog release 5.2.0. The publication is at https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final.
- NIST published SP 800-55 Volume 1, Measurement Guide for Information Security: Identifying and Selecting Measures, in December 2024, at https://csrc.nist.gov/pubs/sp/800/55/v1/final. The 4 types of measures are in section 3.3, and the elements of a measurement report are in section 3.1.2.
- The PCAOB’s AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, covers design effectiveness in paragraph .42, operating effectiveness in paragraph .44, the timing of tests in paragraph .52 and roll-forward procedures in paragraph .55. It is at https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201.
- The Institute of Internal Auditors published the executive knowledge brief Combined assurance: Aligning assurance for effective risk management in February 2022, and it describes the assurance map on page 7. It is at https://www.theiia.org/globalassets/site/resources/knowledge-centers/executive/executive-knowledge-brief/documents/iia-executive-kb—combined-assurance.pdf.
- The Center for Internet Security publishes CIS Controls v8.1, and Control 1, Inventory and Control of Enterprise Assets, is at https://www.cisecurity.org/controls/inventory-and-control-of-enterprise-assets.
- Every source above was read on 26 September 2026.
Do this once instead of every audit.
Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
