Which of the following processes measures the maturity level of the security program?

Risk analysis identifies and evaluates potential threats and their likelihood, not the maturity level of security controls or processes.

Risk mitigation refers to the actions taken to reduce identified risks, not to measuring or benchmarking a security program's maturity.

Risk assessment evaluates the probability and impact of specific risks, not the overall capability or maturity of the security program.

GAP analysis compares the current state of a security program against a target or baseline maturity framework (such as CMMI or NIST CSF), identifying gaps that must be closed. It directly answers 'how mature are we?' by mapping existing controls and practices against defined maturity levels. The other risk-related processes focus on threats and likelihoods, not maturity measurement.