A gap analysis of security controls means comparing and contrasting the $"$as is$"$ to the $"$to be$."$ Common baseline security controls include methods to continue critical operations in the event of business interruptions. This is also called:

business continuity management.

correct processing in applications.

information security policies.

vulnerability management.