A quantitative methodology for information security control gap analysis. - Sulagna Bandopadhyay; Anirban Sengupta; Chandan Mazumdar (ICCCS, 2011)