Compliance Tools

Real-time compliance posture across every active framework. The Compliance Monitor continuously assesses control effectiveness, detects drift when evidence ages, and surfaces cross-framework gaps.

Three-layer dashboard

Layer 1 — KPI bar

Four server-computed numbers visible above the fold:

• Overall score — weighted percentage across all active frameworks
• Open gaps — controls with no evidence or failing tests
• Drift alerts — controls whose evidence has gone stale or missing
• Evidence events — the count of governance events recorded in the period

Numbers come from server-side queries — never computed in the browser.

Layer 2 — Framework cards

One card per active framework showing:

• Coverage gauge (percentage of controls with evidence)
• Control counts by status (compliant / partial / gap / not applicable)
• Certification tier if applicable
• Last evidence event timestamp

Layer 3 — Gap heatmap

Cross-framework matrix. Rows are 10 control domains, columns are frameworks. Cells are colour-coded:

Control domains include access control, monitoring & logging, change management, incident response, encryption & integrity, risk management, human oversight, transparency, data protection, business continuity.

Drift detection

When evidence for a control exceeds a threshold age (default: 90 days), the monitor raises an alert:

• stale — last evidence event is older than threshold
• no_evidence — control has never been evidenced

The threshold is configurable per monitoring run. Alerts surface in the KPI bar and can trigger notifications via the HITL inbox.

Posture computation

The overall score is weighted:

• Compliant controls count as 1.0
• Partial controls count as 0.5
• Gap/non-compliant count as 0
• Not-assessed controls are excluded from the denominator

A control's status is derived from its evidence count, chain integrity, and last-update timestamp — not from a manual toggle.

Frequently asked questions

What do the four KPI numbers at the top actually show?

Overall score (a weighted percentage across all active frameworks), open gaps (controls with no evidence or failing tests), drift alerts (controls whose evidence has gone stale or missing), and evidence events (the count of governance events recorded in the period). The numbers come from server-side queries, never computed in the browser.

How is the overall posture score calculated?

Compliant controls count as 1.0, partial controls count as 0.5, and gap or non-compliant controls count as 0. Not-assessed controls are excluded from the denominator.

What triggers a drift alert?

When evidence for a control exceeds a threshold age, 90 days by default, the monitor raises an alert: stale (last evidence event older than the threshold) or no_evidence (control never evidenced). The threshold is configurable per monitoring run.

What does the gap heatmap show us?

A cross-framework matrix where the rows are 10 control domains and the columns are frameworks. Cells are colour-coded: green for strong coverage, amber for partial coverage, red for critical gap, and grey for not applicable to that framework.

Glossary