Determine which compliance requirements can be demonstrated and are demonstrated regularly. Determine if audit trails are in place and to what degree. Are controls established and enforced? Identify and quantify the gaps.

Those gaps that present an unacceptable risk are classified as needing to be addressed in an actionable plan.