Board Reporting
Comparison and movement
What changed since the previous assessment, computed from two stored measurements rather than inferred from the current run.
The states
New, reopened, persistent, closed, and not re-assessed.
Why two measurements
Because movement inferred from one assessment is not movement, it is a guess. The comparison reads a stored snapshot from the previous run and compares it to the current one.
The state that carries the most weight
Not re-assessed: failed before, and not evaluated now. Explicitly not closed.
A lost permission, a narrowed region scope or a scanner upgrade all remove controls from the denominator, and counting them as fixed would report a collection failure as progress.
Persistent survives a changed resource set
A control failing in both assessments stays persistent even where the failing resources changed. A different set of failing resources is not evidence the original problem was solved.
The window
The snapshot is retained for 90 days by default. Beyond that no predecessor is found and the pack renders as a first assessment, worded as one.
What it does not mean
Movement is not causation. The pack reports that a control closed, not why.