Explanation
Talsoft defines the right level based on assets, exposure, external pressure, permissions, test window and remediation capacity.
View all questions
When should we start with GAP?
Direct answer
When critical assets, baseline controls, owners or remediation capacity are unclear.
When the answer changes
The real value appears when scope is defined with business context and findings connect to owners, remediation, re-testing and evidence.
Example or context
Scope intake before proposal.
Risks and limitations
An isolated cybersecurity service can produce a report. A maturity-connected service produces criteria, evidence and execution sequence.
Related service
Penetration Testing for companies tied to the roadmapAuthor and reviewer: Leandro Ferrari · Last reviewed: 2026-07-13 · Version 1.0.0
Source: current Talsoft public content.
The answer depends on context and does not guarantee certification, compliance, external approval or risk elimination.
Request scope