Closing gaps: how to plan the work

An assessment usually finds more gaps than a team can close at once. This guide explains the order ReversePath suggests, how to run the work, and what “closed” should mean.

1. Start with what could do the most harm

Critical gaps come first, whatever their date. They sit where harm to people is greatest and where the Act’s penalty ceilings are highest: security safeguards, breach reporting and children’s data. A gap answered “Not sure” on a critical or high control is treated as urgent too, because finding out is quick and the answer may be bad.

2. Respect the prerequisites

Some fixes depend on others. You cannot sign data terms with every vendor until you know who your vendors are, and you cannot write a notice until you know what you collect. Your result lists an open prerequisite just before the action that depends on it.

3. Use the law’s dates

Most duties apply from 13 May 2027. Gaps on duties not yet in force are preparation items, not current breaches, and the roadmap places them before the date they take effect. Good practice with no commencement date comes after the work that the law requires.

4. Give every gap an owner and a date

A gap without an owner stays open. Assign each one to a person who can actually change the thing: the IT lead for two-step sign-in, the office manager for the visitor register, the person who signs vendor contracts for data terms. Set a due date inside the phase, and keep a short note of what was done.

5. Close on evidence, not on effort

A task is not closed because work was done; it is closed because something shows the control now works. In the workspace a task moves from Open to In Progress, then Evidence Submitted once current evidence is attached, then Under Review, and only an account owner closes it. Returning a task needs a comment saying what is missing.

6. Re-assess to record the new position

Closing tasks does not rewrite the assessment you started from; that stays as a record of where you were. When a batch of work is done, run a re-assessment. It copies your earlier answers so you change only what has moved, and the new result shows the improvement with its date.

Where outside help fits

Some fixes are simple and internal. Others need a professional: a lawyer to draft notices and vendor terms or to advise on an exemption, a security specialist to test systems, a chartered accountant on retention periods set by tax law. ReversePath tracks the work and the evidence; it does not replace that advice. How partners work with us.