In the context of information security, what is the primary purpose of a gap analysis?

In the context of information security, what is the primary purpose of a gap analysis?

• To identify vulnerabilities in an organization's security posture
• To measure the effectiveness of security controls
• To compare the current security state with a desired state
• To determine the potential impact of a security breach