What goes in a SOC 2 dashboard in Metabase?

A SOC 2 dashboard tracks readiness for one specific audit: control status grouped by Trust Services Criteria, evidence collection racing the audit window, policy acknowledgment, vendor reviews, and exception aging. It's narrower and more time-boxed than the multi-framework compliance posture dashboard — this page is about walking into the audit window with nothing outstanding. Metabase builds it from your GRC platform's API or a controls table in the warehouse.

What does a SOC 2 dashboard look like?

Here’s the layout this guide builds. The readiness row leads with the audit-window countdown and the outstanding-evidence count, because those two numbers set the tone for everything else; controls and evidence follow, grouped by Trust Services Criteria with the cumulative collection pace; the bottom section covers the human and third-party checks — policy acknowledgment, vendor reviews — and ends in the failing-controls table with owners and remediation dates.

Which cards belong on a SOC 2 dashboard?

The eight below cover what the audit will actually test: control operation, evidence across the period, the people and vendors in scope, and the gaps you already know about.

• Days to audit window — the countdown that gives every other card a deadline (number)
• Control status by Trust Services Criteria — passing, failing, needs evidence per criteria (stacked bar)
• Evidence collection for the audit — items collected against the total required (progress)
• Evidence items collected — cumulative — weekly pace toward the window (area)
• Policy acknowledgment by department — % of staff acknowledged, worst last (row)
• Vendor security reviews — complete, in progress, not started, overdue (donut)
• Open exceptions by age — under 30 through over 90 days (row)
• Failing controls — the remediation worklist with criteria, owner, and due date (table)

What data does the dashboard need?

• A soc2_controls table — control, mapped criteria, owner, status — from your GRC platform’s API or maintained by hand.
• evidence_requests with control_id, due_at, collected_at, and owner — the progress and pace cards both read from it.
• An audit_periods table holding the observation window and window_opens_at, so the countdown is data, not a sticky note.
• Policy acknowledgment records joined to HR headcount per department — the denominator matters as much as the numerator.
• A vendor_reviews table with vendor, tier, due_at, and completed_at; plus an exceptions table with opened_at for aging.

How do you build it?

1. Sync control and evidence state from your GRC platform daily via its API — or maintain the tables directly in the warehouse if you run the program without one.
2. Anchor everything to the audit period: store the window dates once and derive the countdown, evidence due dates, and “in period” flags from that row.
3. Group controls by Trust Services Criteria for the stacked card, and keep a three-state status — passing, failing, needs evidence — so “green” can’t hide an un-evidenced control.
4. Chart evidence collection cumulatively against the required total; the slope against the countdown is the single most useful read on the page.
5. Add filters for criteria, control owner, and date range, and send the failing-controls table to owners weekly — with the countdown number in the subject line.

Example card SQL

SELECT
c.criteria,                          -- Security, Availability, …
COUNT(*)                                          AS controls_in_scope,
COUNT(*) FILTER (WHERE c.status = 'passing')      AS passing,
COUNT(*) FILTER (WHERE c.status = 'failing')      AS failing,
COUNT(*) FILTER (WHERE c.status = 'needs_evidence')
                                                  AS needs_evidence,
COUNT(e.evidence_id) FILTER (
  WHERE e.collected_at IS NULL
    AND e.due_at <= a.window_opens_at
)                                                 AS evidence_outstanding,
MIN(a.window_opens_at) - CURRENT_DATE             AS days_to_audit_window
FROM soc2_controls c
JOIN audit_periods a
ON a.audit_id = c.audit_id AND a.is_current
LEFT JOIN evidence_requests e
ON e.control_id = c.control_id AND e.audit_id = c.audit_id
GROUP BY c.criteria
ORDER BY controls_in_scope DESC;

Related

Metrics

Integrations

Dashboards

FAQ