Compliance gap analysis for vulnerability management