Evidence dashboard

The dashboard is the operator's daily glance. Open it once a day; if everything is green, move on. If anything is red, click in and read the details JSON. The dashboard is at MFI → Tools → SOC 2 → Evidence.

What the list shows

Column	Source	Meaning
Code	mfi.soc2.evidence.control_code	e.g. CC6.1-MFA
Topic	joined from control	e.g. MFA enforced on staff
Collected at	evidence.collected_at	When this evidence was produced
Pass	evidence.pass	Green tick or red cross
Summary	evidence.summary	One-liner from the check function
Details	evidence.details	Open to read the JSON

Useful filters

• Failed only — Pass = False
• By cadence — Daily / Weekly / Monthly / Quarterly
• Last 7 days — Collected at > today minus 7
• By control code — CC6.* (Common Criteria 6 family)

Worked scenarios

Scenario — Florence's morning evidence glance

Setting: Monday 08:30 — start of a normal week.

Character	Role
Florence Achieng	DPO + Compliance Officer

Timeline

1. 08:30: Opens MFI → SOC 2 → Evidence. Sorts by Collected at desc. (Last 24 hours of evidence visible)
2. 08:31: Eight controls collected overnight; one cadence skipped (CC6.2 monthly). (Filter: failed only — 0 results)
3. 08:32: All green. Closes the tab. (Spent 90 seconds on SOC 2 today)

Outcome — All evidence collected; no action required. The 90-second glance is the daily ritual.

Scenario — A red CC7.1-VULN spotted

Setting: Tuesday 08:30 — vuln scan didn't run.

Character	Role
Florence Achieng	DPO
Samuel Kibet	IT lead

Timeline

1. 08:30: Florence sees CC7.1-VULN red. Opens the evidence record.
2. 08:31: Details JSON shows last_vuln_scan_at = 9 days ago. Threshold is 7 days. (Failure cause clear)
3. 08:32: Sends Samuel a Slack message: 'CC7.1 red, scan 9 days stale'.
4. 10:00: Samuel runs the scan manually + investigates the cron failure (disk full on GVM host).
5. 10:30: Hook posts updated counts. Next cron run (overnight Wed) will flip CC7.1 green. (Florence adds chatter note documenting the incident)

Outcome — Red spotted within minutes; root cause fixed within 2 hours; control green within 24 hours; auditor will see the gap + the documented fix.

Reference

Evidence record states

State	Meaning
passed	Check function returned pass=True
failed	Check function returned pass=False
error	Check function raised an exception — investigate logs
skipped	Cadence said not due yet
override_pass	DPO manually marked as compensating-control — audit trail required

Troubleshooting

Symptom	Likely cause	Fix
Dashboard empty on a new install	Cron hasn't run yet	Run manually: Settings → Technical → Scheduled actions → 'SOC 2 evidence collect' → Run.
Old evidence cluttering the list	No archival policy configured	Use the filter 'Last 90 days' as default view; older evidence stays for audit but is hidden.
Click on a record gives 404	Record was archived but list cache stale	Reload the page; the cache invalidates.

See also

• Soc2 Evidence
• Controls
• Export