Applying the benchmark is a process that consists of
verifying which of the 112 security mechanisms are included
in the software package, build a gap analysis matrix, and
calculate the security compliance metric. First, the
benchmark user must check whether each of the security
mechanisms is present on the software package being
analyzed. This provides a “gap” list of what mechanisms are
not present and can be used in a gap analysis of several
alternative packages allowing a high level comparison of
compliance (see Table VI for an example of a gap analysis
matrix). The security compliance metric is then computed as
the sum of the weights of all the security mechanism present
in the package. Note that this number must be interpreted
carefully. A higher value does not necessarily means a more
secure product; it means that it offers more support for
implementing security best practices in the context database
installations.