Gap audits that end in an approved roadmap
Each control area against the framework your client chose, where they are and where they need to be, and a roadmap they approve phase by phase.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
QuoteCloud lets a security consultancy send a gap audit as one document: control areas assessed against the framework the client chose, current and target maturity, findings in plain language, and a roadmap priced as a price table where phase one is included and phase two items are options the client ticks before signing and paying a deposit.
Last reviewed by the QuoteCloud team
An engineered drawing of eight control areas, C-01 to C-08, as columns on a plate. Each column's height is the consultant's current maturity score from 1 to 5, and a dashed outline on top shows the target: asset inventory, incident response and suppliers stand at 1 with a target of 3; access and backup at 2 with a target of 4; governance at 2 with a target of 3; patching and staff awareness already meet their target. The gaps light in green and a green line runs to the roadmap card for Oakhurst Health Partners: phase 1 (incident response plan $3,800, asset inventory $2,900, supplier review $2,200) and phase 2 options (backup restore test $1,900 ticked, policy refresh $4,200 and MFA rollout $2,600 not ticked), total $11,880.00 inc tax with 25% on signing, signed by Dr Samir Haddad and paid through PayPal.
The audit and the roadmap in one document
Oakhurst Health Partners chose the framework; Imani assessed eight control areas against it. The audit shows where each area stands and where it needs to be, then turns the gaps into a roadmap the practice can approve straight away.
Phase 1 closes the three gaps. Phase 2 is a list of options: tick the backup restore test and the total and 25% deposit follow. Try it.
- Met, partial or gap, area by area
- Current and target maturity: your scores
- Phase 2 items as options
- Deposit on signing via Stripe or PayPal
Price tables and payments: Essentials and up
Remediation quotes priced from findingsControl areas: where you are and where you're going Against your chosen framework
- 2Met
- 3Partial
- 3Gap
- C-01 Governance & policiesPolicies exist but are three years old. Partial
- C-02 Asset inventoryNo single list of devices across the clinics. Gap
- C-03 Access & identityMFA on email; not yet on the practice system. Partial
- C-04 Patching & vulnerabilitiesMonthly scans and patching in place. Met
- C-05 Backup & recoveryBackups run; a restore has never been tested. Partial
- C-06 Incident responseNo written plan or contact list. Gap
- C-07 Suppliers & third partiesNo review of who holds patient data. Gap
- C-08 Staff awarenessAnnual training for every clinic. Met
Where you are TargetScale: Initial → Developing → Defined → Managed → Optimised
Your roadmap
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Phase 1 · next 90 days | $8,900 | ||
Incident response plan & contact treeCloses C-06 · a tabletop exercise with the practice managers
|
1 lot | $3,800 | $3,800.00 |
Asset inventory across five clinicsCloses C-02 · devices, owners and what they hold
|
1 lot | $2,900 | $2,900.00 |
Supplier reviewCloses C-07 · who holds patient data, and on what terms
|
1 lot | $2,200 | $2,200.00 |
| Phase 2 · choose what to add Tick to add | |||
| 1 lot | $1,900 | $1,900.00 | |
| 1 lot | $4,200 | $4,200.00 | |
| 1 lot | $2,600 | $2,600.00 | |
- Subtotal
- $10,800.00
- Tax (10%)
- $1,080.00
- Total
- $11,880.00
- Plus, monthly
- $0.00/mo
- Deposit on signing (25%)
- $2,970.00
Accept, sign and pay
Dr Samir Haddad · Practice principal, Oakhurst Health Partners
Signed online · 26 Oct, 6:48 pm
Deposit on signing (25%)
$2,970.00
Paid via PayPalPay with card or PayPal
Certificate of authenticity and audit trail attached
Your control wording, reused in every audit
Keep each control area's description, your maturity scale and your methodology in a content library. A new audit assembles from them, and only the findings are new.
- Maturity scale: Initial to OptimisedText block Locked
- Methodology and limitsText block Locked
- C-01 Governance & policiesControl description
- C-02 Asset inventoryControl description
- C-05 Backup & recoveryControl description
- C-06 Incident responseControl description
- Roadmap itemsPrice table lines
- About NorthlatchCompany block
- 1Cover and scopeFive clinics, the framework the practice chose
- 2How we assessed Locked block
- 3Maturity scale Locked block
- 4Control areasYour findings for this client From library
- 5Incident response From library
- 6RoadmapPhase 1 included, phase 2 options From library
- 7About us From library
Content libraries
Saved blocks your consultants insert in a click.
Essentials and up
Locked blocks
Scale and methodology can't be edited by accident.
Business
What goes in a gap audit
The parts every audit shares, so each new one is a review of findings, not a document build.
Your chosen framework
The client's framework named in your words. QuoteCloud never certifies against it.
Current and target
A maturity meter per control area, scored by your consultant.
Findings in plain language
One line per area: what you saw, and why it matters to this client.
A priced roadmap
Phase 1 included, phase 2 as options the client ticks.
Their answers first
A questionnaire inside the audit, answered before the workshop.
Signed and paid
The principal signs and pays the deposit on signing.
Turn your next gap audit into an approved roadmap
Free for 14 days, no credit card. We'll convert one of your audit templates during the trial.
Ask the questions inside the audit
Before the workshop, Lucy answers a few questions in a Forms block inside the audit document: which clinics, who approves spending, whether a restore has ever been tested. The answers come back with the document.
A Zapier trigger, Form Submitted on Document, can pass the answers on to your CRM or ticketing tool through its own Zapier connector.
- A form inside the document, not a website form
- Text, choices and email fields
- Answers arrive with the document
Forms block: Essentials and up
Forms in documentsBefore the workshop: a few questions
A Forms block inside the audit · the answers come back with the document
- Clinics in scope
- All five
- Who approves security spending?
- Dr Samir Haddad, practice principal
- Have you tested restoring a backup?
- No / not sure
- Systems that hold patient data
- Practice system, imaging, email
- Workshop contact
- lucy.brennan@example.com
- Preferred workshop day
- Tuesday mornings
Activity
- Questionnaire answeredLucy Brennan · Forms block
- Audit and roadmap sentImani Rourke
- Backup restore test ticked+$1,900.00
- Signed · 25% paid$2,970.00 via PayPal
After signing, the roadmap becomes a plan
Add a Gantt chart to the audit so the practice sees when each item lands: incident response first, the inventory alongside, the restore test once the backups are mapped.
It's your planning, shown in the document; QuoteCloud doesn't schedule or track the work.
Gantt chart: Business plan
Roadmap after signing (weeks)
From the workshop to a signed roadmap
How a gap audit runs in QuoteCloud.
Send the questionnaire
The audit opens with a Forms block the client answers first.
Assess and score
Your consultant scores each area against the client's chosen framework.
Price the roadmap
Phase 1 included, phase 2 as options from your library.
Review and send
Big roadmaps can need approval on total value first (Business).
Signed and started
The client ticks options, signs and pays the deposit.
Gap audit questions
Does QuoteCloud certify my client against a framework?
No. The gap audit is your assessment against the framework your client chose, written in your template. QuoteCloud doesn't audit, certify or verify compliance; it presents your findings and roadmap and collects the signature and deposit.
Can I reuse my control wording across audits?
Yes. Save control descriptions, your maturity scale and your methodology as content library blocks (Essentials and up) and insert them into each new audit. Lock the ones nobody should edit with content locking (Business).
How do clients choose roadmap items?
Phase 2 items are optional rows in the price table. The client ticks what they want, the total and deposit update, and they sign and pay on signing through Stripe or PayPal.
Can the client answer questions inside the audit?
Yes, with a Forms block, a form inside the document (Essentials and up). Answers come back with the document, and the Zapier trigger Form Submitted on Document can pass them to other tools.
Are the maturity scores calculated by QuoteCloud?
No. Current and target maturity are your consultant's scores. QuoteCloud shows them as a meter beside each control area so the client can see the gap.
Can I show the roadmap as a timeline?
Yes. Add a Gantt chart to the document to show when each item is planned. It's on the Business plan, and it shows your planning; QuoteCloud doesn't schedule or track the work.
More for security firms
Advisory retainers, reports and the quotes that follow.
-
vCISO & advisory retainersAdvisory days a month as packages the client chooses, with the board reporting and roadmap in writing.Explore
-
Remediation quotes priced from findingsFindings by severity × hours × rate in a Spreadsheet block that sets the price lines, plus a retest the client ticks.Explore
-
Cybersecurity templatesReal QuoteCloud cybersecurity, SLA and consulting templates, ready for your report and quote layouts.Explore
- AI-drafted reports & quotes with MCPYour AI assistant, connected through QuoteCloud's MCP service, drafts the report and the priced quote for an analyst to review.
- Vulnerability scan reportsMonthly and quarterly scan results as a branded report: severity summary, findings, trend and what to fix first.
- Penetration test reportsExecutive summary, findings with evidence and retest status, and the client's sign-off in one document.
- Monthly managed security reportsThe month in alerts, incidents and patching from your monitoring platform, with next month's recommendations to tick.
- Penetration test & assessment proposalsScope by IPs, apps and APIs, days worked out in your scoping sheet, and extra tests as options.
- Managed security service proposalsEndpoints and users × service tier → the monthly price, on a term, with renewals you can see coming.
- Authorisation to test & signingRules of engagement and written authorisation signed by every party, then a deposit or full payment on signing.
- Integrations & automationMCP, the API, Zapier and Make, plus CRM, accounting, Slack and Teams, connected the way each one really connects.
- QuoteCloud implementation for security firmsReport and quote templates, your pricing sheet, the MCP connection and analyst training, step by step.
- FAQAnswers to the questions MSSPs, pen-testers, security consultancies and vCISO firms ask most.
Find the gaps, and get the roadmap approved
Start a free 14-day trial: build your gap audit template with your control wording and a priced roadmap.