Types of assessment

  • 4:07
  • Concept
  • Narrated by Sekura
  • English
  • Updated Oct 2026

TranscriptClick a line to jump there

What Sekura says

0:00In this lesson you'll learn what a framework is, the two types of assessment Sekit runs, and how to choose between a readiness and a gap analysis for a company.0:10First, what is a framework? It's a published set of security requirements, such as ISO 27001, NIS2 or the Spanish ENS. Every assessment in Sekit measures one company against one framework. You can browse them all in the Control Library, on the Explorer view.0:31Look at the Regime column. It says what the outside world does with each framework. Certification: an accredited body issues a certificate, as with ISO 27001. Attestation: an auditor issues a report, as with SOC 2. Regulation: it's the law, as with NIS2. Best practice: a voluntary reference.0:56Against any framework, you can run two types of assessment. Both live on the company's Gap Analysis page, whatever their type; here you see one of each. They answer different questions, so let's look at each.1:09A Gap analysis answers: how compliant is this company today? You grade each control Pass, Partial, Gap or Not applicable, and every gap gets a severity, from Low to Critical. That's what turns into a gap report.1:25A Readiness answers: how much work is left before certification? Each requirement is simply Completed, In progress or Not started. There's no severity, because nothing is being graded yet. It turns into a readiness plan.1:40Let's start one. With the company selected, open Gap Analysis in the sidebar. You'll see its analyses as cards. Click New analysis.1:50A drawer opens. First, choose the Framework. The list holds the built-in frameworks and, below them, any custom frameworks your team has built.2:01One exception: on Sekit CSF, Sekit's own framework, you can only run a gap analysis. The drawer tells you so, and the choice of type doesn't appear.2:12On any other framework, choose the Evaluation type: Gap analysis or Readiness. The line underneath reminds you what each one records.2:22Finally, write the Reason / context, in a few words: why you're running it. It becomes the analysis's name. Then click Start analysis.2:33Here's the example company, Acme, preparing for ISO 27001 certification. Notice that ISO 27001 appears twice in the library: the Annex A controls, and the management system, clauses four to ten. An auditor checks both. The clauses are the management system Acme has to build, and Sekit splits them into a checklist for certification readiness.3:00Acme's main question is how far it is from certification, so its readiness uses the management system, clauses four to ten, and Readiness.3:10Tip. A tip: the evaluation type can't be changed once you start. So ask the client's question first. How far from certification? That's a readiness. How compliant are we today? That's a gap analysis.3:24Besides the readiness, you can grade the Annex A controls in a gap analysis on the same company: here, the Annex A baseline. Each card names its type first, then the framework, so you can tell them apart at a glance.3:39To recap. A framework is the yardstick, and its regime tells you what's at stake. A gap analysis grades each control today, with a severity on every gap. A readiness tracks the work left before certification. And you choose the type when you start, for good.3:58Thanks for watching! For more GRC lessons, visit our Learning Center at sekit.ai/learn-center.

Chapters

You'll learn

  • What a framework is, and where to find them
  • The two types of assessment
  • When to run a readiness or a gap analysis
  • How to start one for a company

Try it

Do it yourself, in 3 minutes

Start a free trial. Sample data is already loaded, and the tour opens on this exact screen.

Start free trialAlready a customer? Open in Sekit

Key terms

Framework
A published set of security requirements, such as ISO 27001, NIS2 or ENS.
Gap analysis
Grades each control as it stands today, with a severity on every gap.
Readiness
Tracks the work left on each requirement before certification. No severity.

NextAssessments

Keep going

Review what Sekura wroteHow-to · 2:43Where Sekura's changes wait for you, how to read their reasoning, and how to settle them.Running a readinessHow-to · 3:30What the agents read and do, how to launch a readiness step by step, and what you get when it finishes.The readiness planHow-to · 3:39Generate the readiness plan from a readiness, read each section, then edit it and share it.