While the Risk Index and the Security Index are calculations concerning the PSR (that is, they concern a qualitative aspect of an object), the Gap Index deals with quantitative aspects of an object. This metric analyzes the number of non-implemented controls for an object and generates a relative number as a result.
The basic formula to calculate the Gap Index for a certain object is: