You should always know two things: how audit-ready you are, and the single most important thing to do next. The workspace answers both, live.
The readiness score
As you set statuses and attach evidence, the workspace computes a percentage complete — per control domain and overall. Implemented controls (with evidence) count as complete; N/A controls with a justification are excluded from the denominator so they don't hold your score down.
The score updates immediately as you work, so progress is visible to you and to anyone else on the account. It reflects what you record, which is what keeps it honest; if you'd rather the number were computed from your live environment, automated compliance posture scoring reads control state from connected systems instead.
Tip: A realistic first score is low — that's the point. A program that starts at 12% and reflects reality is worth far more than a spreadsheet that claims 90% because every row says "yes." Score honestly and the gap list becomes your roadmap.
The gap list
Alongside the score is a prioritized list of gaps — the controls that are not started or in progress, and implemented controls that are missing evidence. Work from the top:
- Missing-evidence gaps first. These are controls you already satisfy but haven't proven — the fastest points to recover.
- High-impact controls next. Access control, MFA, encryption, logging, and backups appear across every framework and every auditor's first questions.
- Everything else, assigned to owners with due dates.
Using the score to plan
- Set a target date for your audit and work backward — the gap count tells you how much is left.
- Review it in your team's standup or weekly sync. A shared number keeps evidence collection from stalling.
- Watch for regressions. If evidence expires (an annual review that's now out of date), the item falls back into the gap list so you catch it before the auditor does.
When the score is where you need it, generate the audit pack.