The gap assessment scores 42 questions across the nine sections of CPS 234, on the same 0 to 4 maturity scale used by the DORA and ISO 42001 modules.
What it is for, and how it differs from the requirements
The 24 requirement rows record whether each paragraph is implemented. The assessment measures how well the duty is discharged. Those are different questions, and CPS 234's repeated use of the word commensurate turns on the second one.
The questions deliberately do not restate the paragraphs. They target the judgements the standard leaves to the entity, which is where a tripartite review concentrates: whether the sizing rationale is written down, whether third party coverage reaches past the outsourcing register, whether testers are functionally independent, and whether the notification clocks have ever been rehearsed.
Scoring
| Score | Meaning |
|---|---|
| 0 | Not Implemented |
| 1 | Initial |
| 2 | Developing |
| 3 | Defined |
| 4 | Optimized |
Questions are weighted 1 to 3 by how much a reviewer cares about them. The overall percentage is computed against every question, answered or not, so an unanswered question reads as a gap rather than being excluded from the denominator. A score of 80 percent or above shows as substantially aligned, 50 to 79 as partial alignment, and below 50 as significant gaps.
Notes and evidence on answers
Each answer takes a note and an evidence URL. Use the note to record the specific fact behind the score, for example which population the third party assessment covered, or the date the notification path was last rehearsed. Those notes are what make a re-assessment next year meaningful rather than a fresh guess.