A capability gap is a shortfall in the people, skills, tools, processes, or operational maturity needed to defend a system effectively. In cybersecurity, it often shows up when an organization has monitoring software but lacks analysts to review alerts, has policies but no practiced incident response, or depends on outside partners for functions it cannot perform itself.
Capability gaps matter because attackers exploit the weakest link in a service chain. A small agency, vendor, or local government with limited staff may miss phishing, fail to patch quickly, or struggle to coordinate during an intrusion, creating a path for wider compromise. Defenders close these gaps by improving staffing, training, playbooks, logging, escalation paths, and shared services. In frameworks like NIST CSF 2.0, this is not just an operations issue; it is a governance and risk-management problem that affects how fast an organization can detect, contain, and recover from attacks.