Free tool · Maturity and compliance gap map
Turn your identity gaps into a plan you can hand to a sponsor.
This is not a maturity score. Tell it what is true today and which rules you answer to, anywhere in the world, and it returns a gap register the frameworks actually shape: the gaps that breach your obligations rise to the top, the ones you did not flag but a rule reaches get surfaced, and each names the controls it touches, the template that closes it, and the order to work in. Unlike the predictability self-check, which reflects your own sense of where identity is drifting, this maps your gaps to the regulations you answer to and returns a sequenced register you can hand to a sponsor.
From The Modern Identity Operating Model by Becky Sandberg. Grounded in the book's Appendix D control crosswalk.
1. What is in scope?
This decides which gaps apply to you. A workforce-only program will not see customer-privacy items.
2. Which frameworks and regulations do you answer to?
Check every one that binds you, wherever your organization and your users sit. These drive the result: they reorder the register by what you must comply with, and surface gaps you did not flag but a rule still reaches.
3. Which of these are true today?
Check every one that is honestly true. Be candid; a blank you should have checked is exactly what step two is built to catch.
Illustrative example of one register entry
Gap: No recurring access review for a high-risk system. Touches: access review / certification controls. Closes with: the Access Review starter. Order: early wave, because a framework you selected reaches it.