Insights · Template
NIST SP 800-171 gap assessment template
A gap assessment is only as useful as its structure. This template defines what is recorded for every requirement so that the result is a plan an assessor would respect, not a list of checkboxes.
How to use it
Before the first step.
- One row per requirement; one template row per column explained below.
- Complete the evidence column before deciding status.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Requirement: identifier and text from the specified revision. | Compliance lead | Requirement list from the publication |
| 02 | Implementation status: implemented, partial, not implemented, not applicable with justification. | Control owner | Status with reasoning |
| 03 | Evidence: the artifact that shows the requirement is met, with location and date. | Control owner | Evidence reference |
| 04 | Gap description: what is missing or deficient, in specific terms. | Assessor | Gap text |
| 05 | Consequence: the exposure the gap creates and its assessment weight. | Assessor | Consequence rating |
| 06 | Action: the specific change that closes the gap. | Control owner | Action text |
| 07 | Owner and date: who closes it and by when, matching the plan of action. | Compliance lead | Owner and date columns |
| 08 | Verification: how closure will be tested and who confirms it. | Assessor | Verification method |
| 09 | Status history: dated entries as the row changes, so progress is auditable. | Compliance lead | History log |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days