Understand the ISO 27001 dashboard and readiness indicators
Read implementation sources, model coverage, drafting progress, incidents and overdue work without interpreting scores as a certification judgement.
Dashboard purpose: find action, not a certificate
The ISO 27001 dashboard brings together information from the ISMS registers, SoA and mapped organisation Controls. Its charts help prioritise review and remediation. A score or pie chart is only a presentation of the source records and model currently available; it does not decide ISO conformity or issue a certificate.
Use each chart as an entry point: check what was counted, whether data is complete, and which record owner needs to act.
1. Read the date labels before comparing metrics
The Incident window selector changes incident-related KPIs. Other cards are current-state measures; historical trend charts cover their own rolling 12-month period. The incident selector is not a global date filter for the whole dashboard.
The dashboard no longer offers an Owner filter because the earlier control did not filter the underlying data. To find who should act, open the underlying record and its owner assignment.
2. Understand SoA status versus shared Control implementation
ISO applicability and justification remain SoA decisions. The implementation visualisation uses the authoritative shared Control Management source where available. Categories may include Implemented, In Progress, Not Started and Unlinked requirements.
- An applicable SoA row without a qualifying adopted organisation-Control mapping is Unlinked; a locally entered “Implemented” value does not grant implementation credit.
- A recommendation or catalogue mapping alone is not evidence that a Control has been adopted or implemented.
- If shared implementation records are unavailable, the chart should indicate unavailable instead of inventing zero or 100%.
- Check applicability totals separately from implementation percentages; they measure different things.
3. Use readiness together with model coverage
The weighted PurpleWASP readiness index is a model-based internal indicator. The corresponding model-coverage display shows how much of the model has available/mapped source information. A high index with limited model coverage still needs investigation; missing information must not be treated as verified success.
Risk-priority bands and overdue-treatment statistics may be shown as Not mapped rather than zero until the shared Risk Management source is integrated through an agreed data contract. Do not interpret “Not mapped” as “No high risks”.
4. Act on the overdue-work chart
The dashboard groups overdue items from existing ISO activity sources, where available:
| Workstream | What to investigate | Counting limitation |
|---|---|---|
| Corrective actions | Open nonconformities and overdue assigned actions. | Depends on the existing nonconformity register logic. |
| Training | Late records and assigned training activities. | Depends on the training register's due-date logic. |
| Management review | Actions from the latest held review. | It is not the sum of all historical review actions. |
| BC/DR testing | Outstanding test follow-up actions. | Available only when the required BC/DR records are present. |
Charts have a textual count alternative. If one source cannot be read, that workstream should show Not available, which is different from a verified zero.
5. Use View Drivers and Priority Actions
- Open View Drivers or the relevant card to see which source or requirement is reducing the current position.
- Open the underlying SoA, organisation Control, audit, management review, incident or corrective-action record.
- Confirm the record is correct, scoped to the intended organisation and current.
- Assign corrective work with a clear owner and due date in the authoritative workspace.
- Refresh and compare after a real source record has changed; do not manually alter statuses solely to lift a percentage.
Examples of responsible interpretation
“The SoA is documented, but our mapped implementation is low”
This can be correct. SoA decisions describe what is applicable; Control Management shows the actual implementation. Check unlinked requirements and control-assurance gaps.
“The risk chart says Not mapped”
That does not mean there are no risks. Review the shared Risk Management source directly until the integration is validated.
“The readiness index increased, so we are certified”
No. Certification is a separate externally assessed conclusion and cannot be inferred from an internal dashboard.
Troubleshooting
A chart is blank or unavailable
Check source availability, permissions, organisation/snapshot context and browser network responses. Do not substitute an assumed number.
A score dropped after the reporting update
Unlinked SoA requirements no longer inherit an optimistic locally entered implementation status. Compare the shared Control mappings and review model coverage before assuming a regression.
Changing Incident window did not change the SoA chart
That is expected. The filter only controls incident-window reporting.