Your gap analysis should be a living thing
The classic gap analysis goes like this: book a workshop, walk through the controls, colour cells green, yellow and red, and save the spreadsheet somewhere safe. Six months later nobody remembers why control 8.16 was yellow, who was fixing it, or whether the answer would still be the same.
The problem is the medium, not the analysis. A spreadsheet is a snapshot. Compliance is a moving picture.
All 93 controls in one workspace
Aquil's Compliance Assistant tracks the full ISO 27001:2022 Annex A: all 93 controls across the organizational, people, physical and technological themes. Each control carries its status, notes and links to the documents and processes that implement it, so "why is this yellow" always has an answer attached.
Because the assessment lives next to your documentation instead of in a separate file, closing a gap and evidencing it are the same motion: write the procedure, link it to the control, done.
See across frameworks instead of starting over
Few organizations answer to exactly one framework. Aquil ships cross-framework mappings that show how work done in one framework carries over to another: which requirements are fully satisfied, partially satisfied or merely related. The mappings are informational by design: they never auto-mark a control as done, because coverage judgments belong to you, not to a lookup table.
The practical effect is that your second framework starts from what your first framework already earned, instead of from another blank spreadsheet.
From gaps to commitments
Gaps aren't only internal. Customer contracts and procurement questionnaires carry security requirements of their own, and Aquil's Requirement Tracker lets you match those external requirements against your controls and per-service status, including flagging when a customer demand outright contradicts how your platform works. That conversation is much cheaper to have before signing than after.
A living gap analysis doesn't mean more work. It means the work you already do (writing procedures, running processes, answering auditors) accumulates in one place, so the analysis is simply always done.