Compliance Dashboard

The Compliance Dashboard is the main landing page of Security Hub CSPM after the engine is enabled. It shows the overall compliance posture of your organization broken down by severity, compliance standard, region, and individual asset.

Accessing the Compliance Dashboard

Expand Security Hub CSPM in the sidebar and select Summary, the first entry in its dropdown. If the engine is enabled (status enabled or partial_failure), you land directly on the Compliance Dashboard. If it is still being set up (in_progress), you see the transitioning progress view instead.

note

In the console this page is called Summary: that is both the sidebar entry and the page header. The name "Compliance Dashboard" is used in this documentation to distinguish it from the umbrella Security Hub Overview.

Header

The header, titled Summary, shows:

• Admin account: the AWS account ID of the Security Hub delegated administrator
• Home region: the primary aggregation region
• Last refresh: how long ago the last findings refresh completed, shown as a relative time (for example "5 min ago") or "never" if no refresh has run yet
• The total failing-finding count, as "N open failing findings across critical, high, medium and low", once the summary has loaded. This total is the sum of the four severity cards below — it deliberately does not claim "all severities", because INFORMATIONAL findings are counted by the API but have no card here

note

Every count on this page — the severity cards, the per-account and per-region tables, and the top-resources table — uses one definition: a Security Hub control finding that is currently FAILED and still open (NEW or NOTIFIED). Findings that GuardDuty, Macie or Inspector forward into Security Hub are excluded, because they belong under their own capability, and findings you have suppressed or resolved are excluded because you have already handled them.

That is the same filter the Findings page applies, so clicking a severity card or an account row lands on a list whose length matches the number you clicked. Per-standard security scores are the one deliberate exception: a score needs passing controls for its denominator, and a suppressed control is still failing in AWS.

• After a refresh completes in this session, "N findings fetched"

A Refresh findings button in the header triggers a new refresh job. It is disabled while a refresh is already in progress, where it reads Refreshing… and its tooltip changes from "Fetch the latest findings from AWS" to "Refresh already in progress".

If CSPM has a partial_failure status, a warning banner appears below the header reading "Security Hub setup partially failed." followed by the recorded error message, with a Review button. Click Review to open the Enrollment page and see which accounts failed.

Severity Cards

Four stat cards display the count of failing findings at each severity level:

Card	Color	Action
Critical	Red	Click to open Findings pre-filtered to CRITICAL severity
High	Orange	Click to open Findings pre-filtered to HIGH severity
Medium	Amber	Click to open Findings pre-filtered to MEDIUM severity
Low	Blue	Click to open Findings pre-filtered to LOW severity

Each card shows a severity icon, the count, and the word "failing finding" or "failing findings" beneath the severity name.

info

These counts are findings whose compliance status is FAILED and whose workflow status is still NEW or NOTIFIED. Triaging a finding to SUPPRESSED or RESOLVED in the Finding Detail drawer removes it from these cards on the next load. There is no card for INFORMATIONAL, and informational findings are not part of the header total.

Standards Compliance

The Standards compliance section shows a progress bar for each enabled standard. Each entry displays:

• Standard name: the display name of the compliance standard
• Passing count: the number of passing controls out of the total evaluated, shown as "N / M passing"
• Score: the percentage of controls passing, color-coded by threshold:
  • Green: score is 80% or above
  • Amber: score is 50% to 79%
  • Red: score is below 50%
• A green check-circle icon only when every counted control for that standard passed. "Nothing is failing" is not enough: a standard sitting at 60% with the remainder UNKNOWN has no failures and still gets no tick, and neither does a standard nobody has evaluated
• A "No data yet" chip, and an empty bar, when no control has produced a pass or a fail yet. A standard whose every control came back UNKNOWN — the usual sign that AWS Config is not recording — reads as "No data yet" here rather than as a red 0%

A control counts as passing only when at least one of its checks passed and none failed; a control with checks that neither passed nor failed counts toward the total as unknown, which lowers the score.

Click any standard row to navigate to its Standard Detail view on the Security Standards page.

A caption below the list notes that standards move from INCOMPLETE to READY within about ten minutes of being enabled, and that pass/fail counts appear only once AWS finishes evaluating controls.

Account and Region Filters

Use the Account and Region dropdowns above the standards list to scope scores to a specific account and region combination. The Account dropdown offers All accounts plus every account that currently has failing findings; the Region dropdown offers All regions plus each configured linking region.

When a filter is active, Prism fetches per-standard scores for that combination and the section subtitle names it; these scores match what you would see in the AWS Console for that account. With no filter, scores are aggregated across all enrolled accounts and linking regions.

Only the standards scores respond to these dropdowns. The severity cards, Findings by region table, and Assets tables stay organization-wide.

info

Control-based scoring is used for all score calculations, matching the method used by the AWS Security Hub console. This means the aggregate score is not a simple average of per-account scores; it reflects the share of controls passing across all evaluated checks organization-wide.

When the Standards List Is Empty

Two different empty states can replace the standards list, and they mean different things:

• "No control data for this account and region yet — pick another combination or refresh findings." appears when an account or region filter is active. That combination has no evaluated controls; another one may
• "No standards enabled yet — enable one from Settings to start scoring this organization." appears with no filter active. No standard is enabled at all; enable one from Settings

AWS Config Warning Banner

If AWS Config is not recording in one or more enrolled account/region pairs, a warning banner appears inside the Standards compliance section:

AWS Config isn't recording in N enrolled account/region pair(s) — the standards can't evaluate those accounts until it's set up.

N counts every account/linking-region pair whose recorder is absent, stopped, or failed to provision. Pairs whose recorder is running, is managed outside Prism, or is still coming up or being torn down are not counted.

Click Set up AWS Config in the banner to open the inline AWS Config setup dialog and enable recorders without leaving the page.

note

The AWS Config banner is non-blocking. You can continue reading the dashboard and refresh findings; only the accounts/regions missing a recorder will have NO_DATA or UNKNOWN control statuses.

Findings by Region

A table subtitled "Failing findings per linking region" breaks the failing findings down by region and severity:

Column	Description
Region	The AWS region
Critical	Count of CRITICAL findings in that region
High	Count of HIGH findings in that region
Medium	Count of MEDIUM findings in that region
Low	Count of LOW findings in that region

Every region with failing findings gets a row; the table is not truncated. Rows are ordered by the total of the four columns, busiest region first, with the region name as a tiebreak — so the order is stable across refreshes that changed nothing. If there are no rows, the table shows "No regional findings yet — refresh findings once AWS has evaluated your accounts."

note

This table and the Assets tables below count findings the same way the severity cards do — a control finding that is FAILED and still open (NEW or NOTIFIED). The four columns here therefore add up to the four cards at the top of the page, and suppressing or resolving a finding drops it from all of them at once. Per-standard security scores remain the one exception, for the reason given above.

Assets with Most Findings

A tabbed table, subtitled "Accounts and resources carrying the highest failing-finding counts", lists the assets to look at first. Both tabs have a Findings count column; the first column is headed Account or Resource depending on the tab.

• Accounts tab: every account that has failing findings, shown as "Name (ID)" where Prism knows the name. Click a row to open Findings filtered to that account
• Resources tab: the ten resources with the most failing findings, highest first, each showing its resource ID with the resource type in parentheses. Hover a truncated row to see the full value. These rows are not clickable

Each tab has its own empty state: "No accounts with findings yet — enroll accounts and refresh findings." and "No resources with findings yet — refresh findings to populate this list."

Refreshing Findings

The Compliance Dashboard shows findings from the last completed refresh job. Results do not update in real time as AWS evaluates controls. To pull the latest findings from AWS:

1. Click Refresh findings in the header.
2. A progress bar appears below the header, with a live label that tracks the job: Fetching findings… while pages are pulled from AWS, then Refreshing controls… and Refreshing controls (N/M)… while the per-standard control snapshot is rebuilt. If the job sends no label of its own, the bar reads Refreshing findings….
3. When the job finishes, the header shows the updated Last refresh time and the count of findings fetched.
4. The severity cards, standards scores, regional breakdown, and asset tables all refresh automatically.

The bar shows a percentage only when Prism can estimate one, which needs a previous completed run to size against. On the very first refresh there is no baseline, so the bar runs indeterminate and its label counts up instead — Fetched N findings….

A refresh queries each linking region directly, rather than relying on the cross-region aggregator, and stores only findings AWS currently reports as ACTIVE. Findings AWS no longer reports are then pruned from Prism, so the dashboard drops resolved issues instead of accumulating them. The prune is skipped whenever the run was not clean — a region that failed mid-run fails the whole job, and even a single finding that could not be stored suppresses the prune — because a live finding that was not re-stamped this run would otherwise be deleted. In either case the previous data is left in place.

note

Only one refresh job can run at a time. The Refresh findings button is disabled while a job is in progress. If you navigate away and return, the page resumes polling the active job automatically.

warning

A refresh run is capped at 50,000 findings. If your organization produces more than that, the job fails with "exceeded max findings cap of 50000; refine scope before retrying" rather than ingesting a partial set. Reduce the number of linking regions or enrolled accounts, or disable a standard, and run the refresh again.

Related Pages

• Security Standards, Per-standard scores and control drill-down
• Findings, Browse and filter the full findings list
• Member Enrollment, Review accounts with partial-failure enrollment status
• Settings, Enable or disable compliance standards
• AWS Config, Enable recorders so standards can evaluate your resources