Page Comparison

Overview

The Compliance Dashboard provides a snapshot of an organization's compliance posture as well as its progression through time.There are several sections on the dashboard that provide detailed metrics around program status and control healthand control statuses.

Accessing the Compliance Dashboard

To access the Compliance Dashboard, complete the following:

1. Click Dashboard | Compliance Dashboard.
   
   
   
   

Anchor
programstatus programstatus

Program Status

The Program Status section area displays all programs in your organization's instance. This alphabetical list provides statuses and shows audit readiness for two phases in a program's timelinedevelopment. 

Image Removed

Image Added

Those two phases of Audit Readiness are as follows:

• Onboarding Phase - The program has no completed audits. This phase checks objective mappings through PSSOC hierarchy, which is done in the Program Onboarding WizardProgram mappings are calculated.
• Audit Phase - The program has at least one completed audit. Control effectiveness is calculated.
   

Onboarding Phase Audit Readiness

If a there is no completed audit, the program is still in the onboarding phase, the message displayed on mouse hover provides percentages of objectives that have mapped controls. This program may have active audits, but if it has no completed audits, there are no metrics to display for control health. The Audit Readiness calculations are based on percentages of objectives with mapped controls. Then the low, moderate and high rating is based on that and not control effectiveness.

Onboarding phase status definitions are as follows:

• Low - No objectives are scoped or control mappings are less than 40 percent. 
• Moderate -  Control mappings are equal or greater than 40 percent and less than 80 percent. 
• High - Control mappings are equal or greater than 80 percent. 
  

The control percentages are only calculated on objectives scoped to the program.

Audit Phase Audit Readiness

If a program is in the audit stage, which means it has there is at least one completed audit, the message displayed on mouse hover  the program is in the audit phase. The Audit Readiness calculations are based on calculations of control effectiveness during the last program audit.

Audit phase status definitions only cover the last completed audit and are as follows:

• Low - Over 80 percent of control assessments are deemed ineffective either by design or operation.
• Moderate -  Over 30 percent and less than or equal to 80 percent are deemed ineffective either by design or operation.
• High - Less than or equal to 30 percent of control assessments are deemed ineffective either by design or operation.
  

Anchor

highriskentity

If an assessment is mapped to multiple objects, the only assessment used for calculations is the one mapped to a control used in the last completed audit.

highriskentity

High Risk Entities

The High Risk Entities section reports shows the top three object types associated with high risk scores, which then provides an organization with the focus for with risk mitigation focus.
Image Removed

Image Added

The numbers in the High Risk Entities section displays three objects with the greatest number of high risk items. Only the following are included in this section's calculationRisk Entities graphic are calculated as follows:

• The entity must be one of the following objectsa(n):

  • Contract
  • Control
  • Org Group
  • Data Asset
  • Process
  • Objective
  • Product
  • Program
  • Threat
  • Policy
  • Issue
  • Market

• The entity must have at least one item classified as high risk object mapped to it.

• The top three entities (or objects) with the most high risks largest number of high risk items are displayed with their counts from left to right. 

Anchor
issues issues

Issues

The Issues section area of the Compliance Dashboard displays the top five outstanding issues in  in ZenGRC. This These issues should then be your compliance team's focus for the next time period.

Image RemovedImage Added

Understanding the Issues Section

The Issues section area displays columns with the following criteria:

• Top 5 issues - This column pulls all the oldest issues in the ZenGRC application, regardless of mappings, that are set to one of the following statuses (other statuses are ignored):
  • Identified.
  • Assigned.
  • Remediation in progress.
• Associated Entities - All This displays all objects mapped to the displayed issue.
• Age - The This is the number of days shown in red since each issue was created. The oldest issues display first.

Future Gap Analysis

The Future Gap Analysis section area provides the an estimated level of effort for achieving compliance with a new framework. The estimate is based on overlapping frameworks in your ZenGRC System of Record.

The section area only pulls programs still in a Draft status.
Image Removed
Image Added

The Future Gap Analysis

The Issuessection  area displays columns with the following criteria:

• Program - These are draft programs with at least one mapped objective.
• Objectives not met - The number of objectives his represents two things:
  • Objectives in the draft program are not
  scoped
  • mapped to
  other
  • objectives in finalized programs.
  These objectives still need to be covered.
  • No controls mapped to objectives of finalized program also mapped to objectives in draft program
• Objectives potentially met - The This is the number of objectives in the draft program that could be potentially met by objectives in a related finalized programare also scoped to finalized programs that have corresponding mapped controls.
• Estimated coverage - Estimate of objective overlap between the finalized and draft programs to show effort in finalizing the draft program This value is computed by dividing the number of objectives potentially met by the total number of objectives (sum of previous two columns).

Risk Heatmap

The Risk Heatmap section area is a scaled-down report on risks the organization is facingfaces along with their likelihood and impact. This provides risk severity and how soon action is necessary.

Click one of the cubes a cube on the grid to open the Risk Heatmap module.

Individual Program Status

Clicking a program in the Program Status area displays metrics regarding the that program's control efficiency of the selected program.

Accessing

Program Metrics

On the Compliance DashboardTo access individual program metrics, complete the following:

1. Click From the Compliance Dashboard, click a linked program in the Program Status section area.

Control Health Metrics

1. The metrics for the selected program

• count controls mapped to the selected programthrough the PSSOC hierarchyand evaluate effectivenessbased on last assessment mapped to the control whose audit has been completed
  • take into consideration the last completed audit:
    • 1st level sorting: "Audited period end" date
    • 2nd level sorting (if 1st level not available or its tied): date when audit was completed
  • count of effective controls
  • count of ineffective controls
  • show effectiveness count: effectives control/all control
    • show gauge color:
      • 0-60 percent: red
      • 61 percent-80 percent: orange
      • 81 percent and above: green
  • show audit readiness badge for program (same as for all programs, user story no. 3 in this spec)
• Click on Effectiveness metrics or on the round percentage: take the user to the SoR listing for controls
  • • filters applied: map:program
    • workaround for now: old SOR, go to program page, controls tab

Section Status

all the sections for this program with metrics about mapped objectives and controls count and highlighted with colors based on control effectiveness

1. display.

Image Added

Control Health

The following sections describe how Control Health metrics are obtained.

Control Count

Regardless of whether the program has a completed audit, the effective and ineffective control numbers on the left side of the graphic are calculated as follows:

• Numbers are based on assessments in the most recent, completed audit.
• If the program has no completed audits, metrics are pulled from audits for other programs that share the selected program's controls. 
• Only controls mapped in the PSSOC hierarchy are counted.
  
  Image Added

% Control Effectiveness

The % control effectiveness in the middle displays colors and percentages that are based on the numbers in the Control Count  described above. The percentages are calculated as follows:

• Red - 0 percent to 60 percent assessed controls are rated effective.
• Orange - 61 percent-80 percent assessed controls are effective.
• Green - 81 percent and above assessed controls are effective.
  
  Image Added
  

Audit Readiness

The audit readiness rating is pulled from Program Status on the Compliance Dashboard home page. 

Image Added

Sections Status

The Sections Status displays sections for the selected program along with the counts for objectives and related controls. The information is separated out as follows:

• Section color:
  
  • Red - Less than 50 percent of the objectives have at least one control mapped.
  • Orange - Between 50 percent and 80 percent of the objectives have t at least one control mappedRed: let than 50 .
  • Green - More than 80 percent of the objectives have at least one control mapped
• Hover on the "badge" same as in US#4 (see above)
• on click take to the SoR objective list:
  • filter is applied: map:program
  • filter is applied: map:section
  • visible column selected: map:control
  • workaround for now: old SOR, go to program page, controls tab
• • .
    
    

Image Added

High Risk Entities

This calculates the top 3 highest risk entities for a specific the selected program only.

Top Five Issues

This displays the top five outstanding issues regarding a specific program

mapped to the selected program only.

Risk Matrix

This section The Risk Matrix displays risks for the selected  program and at what selected program along with the likelihood and what impact, so I can decide on risk severity and how soon do we have to take the action

impact. This narrows the focus of your risk management action to a single program.