Produce a compliance scorecard
Grade one tenant, one group or the whole organisation over a rolling window, read the evidence behind the score, and export it as a letterheaded PDF.
- Version: 0.4
- Feature: compliance
- Role: admin_user, viewer
- Type: task
Compliance Reports turns the same detection data the Compliance page shows into one graded number per subject, with everything needed to argue with it: the three components behind the score, the articles being breached most, what to fix first, and what the score cannot evidence. The Compliance page answers what is happening; this page answers how are we doing, and can I hand it to someone.
What do I need?
- Licence
- Any
- Role
admin_userviewer
Prerequisites
- The appliance has recorded detections in the window you want to grade — an empty window scores nothing rather than 100.
- For a tenant or group scorecard, the account or tenant group already exists.
- For the PDF export, the report-renderer service is running and reachable at REPORT_RENDERER_URL.
admin_user, superadmin, auditor and viewer may open the page; all three handlers behind it
are reads, so nothing on it changes state. A different role is shown Access denied.
/assets/screenshots/compliance-reports@0.4.pngHow the score is built
The score is 100 × (0.5·M + 0.3·C + 0.2·E), rounded, and its three components are computed from
the window you selected:
| Component | Weight | What it measures |
|---|---|---|
| Mitigation, severity-weighted | 0.5 | The share of detections the gateway neutralised — masked or rejected — weighted by the severity of the article behind each one (critical 5, high 3, medium 2, low 1) |
| Control coverage | 0.3 | Holding controls over holding plus partial plus failing. A control short of its floor counts half; untested controls leave the denominator entirely |
| Evidence completeness | 0.2 | How much of the evidence maps to a regulation and attributes to a person |
Grades are A at 90, B at 80, C at 70, D at 60, F below that.
Warning
A window with no weighted detections and no tested control scores N/A, not 100. An empty window satisfies every ratio in the formula trivially, and reporting that as an A would flatter exactly the deployment nobody has instrumented.
Severity weighting is the reason the score is not a mitigation rate. A deployment that blocks 90% of email hits while letting every national identifier through is not 90% compliant, and an unweighted ratio would say it was.
Grade a subject
Open the page
Select Security & Compliance → Compliance Reports.
The page opens on the Scorecard tab for the Global subject over 90 days.
Choose the subject
Select Global, Tenant or Group, then pick the account or group from the selector beside it.
Global means everything the signed-in account may see. Until you pick one, a tenant or group subject shows Pick a tenant to report on. and computes nothing.
Choose the window
Select 7d, 30d or 90d.
The window is a rolling one ending now. The header restates it as a literal date range so the reader of a shared link knows exactly what was graded.
Read whether the figures can still move
Check the line under the score.
Live figures: they change as data arrives. means the report was recomputed from tables that keep moving. Frozen snapshot: these figures will not change. means a compliance snapshot covers exactly this window for this subject, and the report is reproducible. Freeze a period on the Compliance page's Evidence tab.
Read the three components
Open How is this scored?.
The panel prints the weights and answers three questions in the product's own words: How much of what we saw was neutralised?, Are the controls holding? and How complete is the evidence? Each carries the counts behind it, including how many controls were untested and therefore excluded.
Work the evidence behind the score
Find the articles being breached most
Read Which articles are we breaching most?.
Rows are ranked by severity multiplied by volume, not by volume alone — volume alone puts email above national identifiers on every deployment. Up to 20 rows are listed.
Open the detections behind a row
Select any row.
You land on the Compliance page's Detections tab with the regulation, entity type, action, tenant and window that reproduce that exact figure already applied. A figure an auditor cannot open is a figure they have to take on trust.
Read what to fix first
Read What should we fix first?.
Recommendations are derived from this window and ordered by how much score each would return. Up to 10 are listed, and most carry their own drill-through.
Read what the score cannot evidence
Read What can this score not evidence?.
These are limits on what the number is allowed to mean, not actions: unmapped entity types, unattributed detections, controls nothing exercised. A scorecard that listed neither recommendations nor gaps would be claiming completeness it has not earned.
Break a group down by member
For a group subject, read How does the group break down?.
Each member gets its own detections, mitigated count, score and grade. If the sign-in account cannot see every member, the banner You cannot see every member of this group — these figures describe part of the team. appears and the group's real size is still printed.
Find where the exposure is concentrated
Switch to the leaderboard
Select the Leaderboard tab.
The rows are ranked by detection count with each row's share of the window's total.
Choose what the rows are
Set the dimension to Tenant, Article or Entity type.
Tenant is the default — the question most often asked. The subtitle states the denominator, so a share is never read against the wrong total.
Open a row
Select any row.
Same drill-through as the scorecard: the Compliance detections table, filtered to reproduce that row.
Export it
Download the scorecard
Select Download scorecard PDF.
The gateway recomputes the scorecard server-side and renders it through the report-renderer service. A Scorecard PDF downloaded toast confirms it.
Check the cover before you file it
Open the PDF and read the cover block.
The cover carries the subject — a tenant, or a named group with its real member count — the active filters and the period, taken from the same report object the screen is showing, so the cover and the body cannot disagree. With no subject and no filters it prints Entire organization.
Note
The filename carries the subject: compliance-scorecard-<subject>-<date>.pdf. A folder of
files named only by date tells an auditor nothing, which is why the subject is in the name
rather than only inside the document.
Fields reference
Scope bar
| Control | Values | What it does |
|---|---|---|
| Subject | Global, Tenant, Group | Who the report is about. Tenant and group need a selection before anything computes |
| Tenant / Group | An existing account or group | The subject itself. A group resolves to its member accounts, intersected with what you may see |
| Window | 7d, 30d, 90d (default) | The rolling window, ending now |
| Dimension (Leaderboard) | Tenant (default), Article, Entity type | What the ranked rows are |
Every one of these lives in the URL. A scorecard is a document people send each other, so "the 90-day card for the Finance group" survives being pasted into a ticket.
Scorecard panels
| Panel | Shows |
|---|---|
| Score and grade | The number out of 100, its letter, and whether the window is frozen or live |
| How is this scored? | The three components, their weights, and the counts behind each |
| Which articles are we breaching most? | Severity, article, title, detections, mitigated — ranked by severity × volume |
| What should we fix first? | Ranked recommendations, each with a drill-through where one exists |
| What can this score not evidence? | Evidence gaps: limits on the score's meaning |
| How does the group break down? | Group subjects only: one row per visible member with its own grade |
Verify
- The score, the grade and the three components are present, and the header restates the subject and the literal date range.
- Select a violation row. The Compliance Detections table opens with filters applied and the row count matches the figure you selected.
- Freeze the same window on the Compliance Evidence tab, then reload this page. The line under the score changes to Frozen snapshot: these figures will not change.
- Download the PDF and check that the cover names the same subject, filters and period as the screen.
- This page writes nothing to the audit trail. All three of its endpoints are reads, so no event appears in Event logs for opening, filtering or exporting a scorecard.
If it fails
- Access denied — your role is not admitted. Only
superadmin,admin_user,auditorandviewerare. - A 403 with
FEATURE_NOT_LICENSED— the installed licence does not carry thecompliancecapability. See Licensing and activation. - Could not load the scorecard — the request failed. Check that the subject still exists and that you are within your data scope.
- The score reads N/A — the window carries no weighted detections and no tested control. Widen the window, or clear a subject that has no traffic.
- No article-mapped detections in this window. — detections exist but none map to a regulation article. The entity types they carry are outside the seeded mapping table; the evidence-gap panel says so and the evidence component of the score is what it pulls down.
- No visible members in this group. — the group is empty, or every member is outside your data scope.
- Scorecard PDF export failed with a 503 Failed to render compliance scorecard PDF — the
report-renderer service is unreachable. The on-screen figures are unaffected; check
REPORT_RENDERER_URLand that the renderer container is healthy.
Next steps
- Monitor regulatory compliance — the detections, findings and frozen evidence every figure here is derived from.
- AI governance — what AI the organisation is accountable for, which no detection stream can answer.
- Tenant groups — the groups a group scorecard reports on.
Last updated on