What is a gap analysis in the context of NIST CSF implementation?

• A.A review of incident logs and audit findings to rank the controls that failed in the last year
• B.A penetration test of the production network and cloud accounts to find exploitable vulnerabilities before an attacker does
• C.A comparison between the current cybersecurity posture and the desired target state to identify areas needing improvement
• D.A calculation of the financial loss from past breaches and projected incidents to justify the annual security budget to the board