Tutorial: Compliance Scorecard

A compliance scorecard ready to put in front of an executive team or auditor — overall gauge, control-by-control breakdown, non-compliance details, trend over 90 days, branded PDF. Time: ~25 minutes · Difficulty: Beginner

What you’ll build

Large compliance percentage gauge at the top
Per-control progress bars
Drill-down table of non-compliant devices by issue type
90-day trend chart
One-click PDF export with your logo

This pattern works for ISO 27001, NIST CSF, UK Cyber Essentials, CIS Controls — whichever framework you’ve mapped your controls to.

Prerequisites

Dimension access (Analyst or Super Admin)
A device inventory data source (ThreatAware Devices table, or a custom Data Feed)
A defined control framework — at minimum, you need to know which controls you’re measuring

Step 1 — Start a blank canvas

Builder Mode → New App → Blank Canvas Light. Light mode renders better as a printed PDF.

Step 2 — The headline gauge

Create a compliance scorecard for executive presentation.

At the top, show a large gauge (250px+) displaying overall
compliance as a percentage: number of devices passing all
controls / total devices, rounded to one decimal place.

Colour the gauge:
- 95%+ green
- 85–95% amber
- below 85% red

To the right of the gauge, show three supporting metrics:
- Devices in scope (count)
- Devices passing all controls (count)
- Devices failing one or more (count)

Step 3 — Per-control breakdown

Below the gauge, add a section called "Control Compliance" with
horizontal progress bars — one per control. For each, show:

- Control name on the left (e.g. "EDR Coverage", "Disk Encryption",
  "MFA Enrolled", "Patch Currency")
- Compliance % as a horizontal bar (green/amber/red as above)
- Count of failing devices on the right

Order by lowest compliance first so the weakest controls bubble up.

If you’re using a specific framework, name the controls explicitly:

"Add Cyber Essentials controls: firewalls, secure configuration, user access, malware protection, security update management."

Step 4 — Non-compliant devices

Below the per-control bars, add a section "Non-Compliant Devices".

Group devices by their primary failing issue (the first control
they're failing). Within each group, list:
- Device name
- Owner email (assignment from main platform)
- Last seen
- Failing controls (comma-separated)
- A "View device" button that links to the device's main-platform page

Make the groups collapsible. Default-expand groups with 10+ devices.

Step 5 — Trend line

Above the non-compliant section (between the per-control bars and
the table), add a 90-day trend chart showing overall compliance
percentage day-by-day. Use a smooth line with a subtle area fill.

Annotate any drop > 5% with a red marker — useful for spotting
the day a new control was added or a patch wave broke compliance.

Step 6 — Polish for export

Use the following styling:
- Brand primary: #16A34A (replace with your colour)
- Background: white
- Section headers in our brand font, large and bold
- Card-style borders around each section with subtle shadow

Add a header at the very top:
- Logo on the left
- "Compliance Scorecard — <month> <year>" centered
- Generation timestamp on the right

Step 7 — One-click PDF export

Add a "Generate Report" button at the top right that exports
the current view as a PDF in A4 Portrait format.

Below the export button, show the current filter state — for
example "All departments • All OS • 90-day trend" — so the
PDF reader knows what scope they're looking at.

The ⋯ → Generate PDF menu in the editor also works, but the in-app button is friendlier for non-builder users.

Step 8 — Scope filters

Above the headline gauge, add a filter row:
- Department (multi-select)
- OS (Windows / macOS / Linux / iOS / Android, multi-select)
- Date range for the trend chart

All sections below should react to these filters. The PDF
export captures the currently-filtered view.

Step 9 — Publish + schedule

Click Published. Three follow-on options:

Pin to Sidebar — surface it next to Devices, Dashboard in main ThreatAware nav
Share URL — give it a memorable slug like compliance-scorecard
Manual monthly PDF — at month-end, open the app, set the date range to last month, ⋯ → Generate PDF → A4 Portrait, send to leadership

Scheduled PDFs are on the roadmap — when shipped, you’ll be able to email PDFs on a cron schedule directly from the app.

What you’ve built

Component	Audience
Headline gauge	CISO, board
Per-control bars	Compliance owner
Non-compliant device table	Operations / remediation team
90-day trend	Trend reviewer, auditor
Branded PDF	Auditor evidence pack

Customisation ideas

Multi-framework views — “Add tabs at the top: Cyber Essentials / ISO 27001 / NIST CSF. Each tab uses the same data but maps to different controls.”
Auditor-friendly evidence drill-down — “On each non-compliant device, add a button ‘Generate evidence pack’ that fires our Webhook Action to gather raw logs for that device”
Slack on regression — “Whenever overall compliance drops >5% week-over-week, fire the SecOps Slack Webhook Action”
Owner outreach — “Add a ‘Notify owner’ button per device that emails the owner (tenant user) with the failing controls”

Exporting & Sharing

PDF formats, Pin to Sidebar, Share URL

Actions

Email / Webhook Actions for owner outreach and regression alerts

AI Composer

Reference for the Composer prompts pattern

Use cases

Pre-built Apps

Tutorials

Tutorial: Compliance Scorecard

What you’ll build

Prerequisites

Step 1 — Start a blank canvas

Step 2 — The headline gauge

Step 3 — Per-control breakdown

Step 4 — Non-compliant devices

Step 5 — Trend line

Step 6 — Polish for export

Step 7 — One-click PDF export

Step 8 — Scope filters

Step 9 — Publish + schedule

What you’ve built

Customisation ideas

See also

Exporting & Sharing

Actions

AI Composer