Gap analysis

A long register can still miss risks. The gap analysis checks it like the cross-reference table of BSI 200-3. It crosses your asset classes with your threat classes. You mark the pairs that must be assessed, and it shows the pairs that no risk covers yet.

The rule is short. A risk covers a pair when it names that threat class and links an asset of that asset class. An expected pair without such a risk is a gap.

Mark the expected threats

1. Open Risks → Gap Analysis.
2. If some asset classes have no expected threat yet, select Apply suggestions under Gaps to Close. devguard marks the threats that the name of each such class suggests. For example, laptops get loss, theft, and malware; server rooms get fire, water, and power outage. This works for English and German names. Classes that already have expected threats stay as they are.
3. Under Expected Threats, select Show matrix. Click a cell to mark that threat as expected for that asset class. Click it again to clear it.

To mark expected threats, you need the right to edit asset classes: owners and admins have it. Everyone who can read risks sees the analysis.

Close a gap

1. Under Gaps to Close, select the chip of the gap. The create form opens with the threat class already set.
2. Fill in the risk. Under Impact, link an asset of the asset class. Save.

The pair now counts as covered. In the matrix, a covered cell shows the highest level among its risks, in that level's color. A cell whose risks are all unrated shows Not rated.

Reference

The figures at the top count the expected assessments: how many are covered, identified but not rated, and still open. The Open Gaps card of the overview shows the same gaps and links here. Assets → Overview has an Open Gaps card as well; see Assets.

The matrix shows only asset classes and threat classes that are not archived. Deleting a threat class or an asset class removes its expected pairs.

GET /risks/gap-analysis/ returns the asset classes with their asset counts and the threat classes. It also returns one cell per pair: whether it is expected, how many risks cover it, how many of those are unrated, and the highest level. The AI assistant answers the same question with getRiskGapAnalysis.