The Short Answer
A TPN gap assessment is a practice run. Someone compares what your studio does today with the MPA Content Security Best Practices and hands you a written list of what is missing, in priority order. It is different from the formal TPN assessment, which an independent TPN-accredited assessor performs and which gets published to TPN+. The gap assessment is yours to keep private, and its job is to make the real one boring.
TPN publishes a statistic that explains why it matters: it reports that 96 percent of its security assessments uncover gaps. Finding gaps is normal, and the assessor's findings turn into a remediation plan. The point of a gap assessment is to find yours while you can still fix them quietly.
Where a Gap Assessment Comes From
You have three routes, and they overlap.
- TPN+ self-assessment. Creating a TPN+ account and completing the Blue questionnaire for each site and application costs nothing and works as a gap analysis. Your answers are visible only to participating content owners and your chosen assessor, and evidence is optional and visible to the assigned assessor unless you mark it otherwise.
- A consultant-led review. Someone who knows the Best Practices walks the facility, reads your configurations and interviews staff. This is the kind of work our team does. It is separate from the assessor's work, and we do not hold an assessor role.
- Your assessor's own scoping. When you book the formal assessment, the assessor sees your scoping answers first and will flag obvious holes. Treat that as a safety net, not a substitute for fixing things beforehand.
What It Looks At
The Best Practices group controls into four domains: Organizational, Operational, Physical and Technical Security. A thorough gap assessment touches all four, and it checks three things for every control: whether a written policy exists, whether the practice happens, and whether you can prove it.
Organizational. Security policy, risk assessment, business continuity and disaster recovery, incident response, background screening, onboarding and offboarding, training, and the contracts you have with your own vendors.
Operational. How you receive, track, label and destroy client assets, how you handle high-security titles with aliases, and your work-from-home and remote site rules.
Physical. Entry points, visitor logs, electronic access control and its logs, alarms, cameras, key control, and environmental controls for the server room.
Technical. Network separation, firewall rules, remote access, Wi-Fi, authentication, endpoint protection, encryption, patching, vulnerability scanning, penetration testing, content transfer and, since version 5.3.2, a set of AI controls.
For each control, the result is one of the same outcomes an assessor uses: fully implemented, partially implemented, not implemented, or not applicable. Partial and not implemented items go on the remediation list.
The Gaps That Come Up Most
We keep this list as observations, not statistics. Nobody publishes a ranked failure table, and we will not invent one. These are the areas where small post houses most often have a practice but no proof, or no practice at all.
- No written policies. The shop does the right things informally. The Best Practices ask for policies that are established and regularly reviewed, so unwritten habits count as a gap.
- A flat network. The office, guest Wi-Fi, NAS and edit bays share one network. The Best Practices call for isolating content and production networks from everything else, by VLAN access lists or an air gap, with no bridging.
- MFA only on some systems. The control asks for multi-factor authentication on internet-facing systems and administrative access, with an authenticator app or hardware key as the second factor.
- Unpatched storage and network gear. Patching extends to NAS units, firewalls and switches. Firmware on a NAS that nobody has touched since installation is a common find.
- No vulnerability scans or penetration test. The controls set a floor of monthly external scans, quarterly authenticated internal scans and an annual penetration test.
- USB ports open on content machines. The configuration control blocks external and mass storage on systems that hold content, except the content transfer system.
- Freelancers outside the process. Onboarding, offboarding and training are meant to cover contractors and freelancers as well as staff.
- No evidence trail. Visitor logs not kept for a year, no training log, no record of who approved a transfer.
- No tested incident plan. A plan that exists but has never been read aloud.
What You Get at the End
A good gap assessment gives you:
- A list of controls with a status for each
- A ranked remediation plan with an owner for each item
- A list of documents to write
- A rough sequence that puts quick wins first and structural network work in the middle
Structural changes take the longest. TPN says minor findings may take weeks, while structural or process changes may take several months.
How to Use the Result
Do not rush to book the assessor. Fix the high-risk gaps first, then run the questionnaire again so that your answers match reality. TPN lets you move up tiers as you remediate: submitting a remediation plan for every finding earns Silver, and finishing the Best Practice items, reviewed by TPN, earns Gold. There is no deadline for remediation, so you can set your own pace. For the full control-by-control list, start with our readiness checklist, and for plain-English explanations of the framework read the Best Practices explained. If your biggest worry is everyday exposure rather than paperwork, cybersecurity for post-production studios covers the common weak spots.
Want a person to help?
A real person on our team can run the gap assessment, write up what we find, and help you work through the fixes. We help you get ready. The formal assessment is done by an independent assessor chosen from TPN's directory, and nobody on our side certifies you or guarantees a result. Look at our TPN certification consulting and our network security work, or plug us in and tell us what your setup looks like.
Questions people ask
Is a gap assessment required before a TPN assessment?
No. TPN does not require one. The Blue self-assessment questionnaire on TPN+ is free and works as one, and most studios find it cheaper to fix gaps before an assessor finds them.
Who sees the results of a gap assessment?
If you do it privately or with a consultant, only you. If you complete the TPN+ questionnaire, your answers are visible to participating content owners and your chosen assessor once you publish with a paid membership.
How many gaps should we expect?
TPN reports that 96 percent of its security assessments find gaps, so expect some. How many depends on how much of your practice is written down and how your network is built.
Do we fail if the assessment finds gaps?
TPN says its Shield statuses are not a pass or fail. Findings go into a remediation plan, and you move up the tiers as you close them. Each content owner decides what it will accept.
Written by the team at Clouds Agency, a Los Angeles creative and production consulting agency.