Findings
Finding lifecycle
The five states a control can be in between two assessments, including the one that must never be reported as a fix.
Currentengine 9.0.0Verified 2026-08-30
The states
| State | Meaning |
|---|---|
| New | Failing now; never evaluated before |
| Reopened | Failing now; evaluated as passing before |
| Persistent | Failing in both |
| Closed | Failed before, evaluated now, now passing |
| Not re-assessed | Failed before, not evaluated now. Explicitly not closed |
Why the last one exists
A lost permission, a narrowed region scope or a scanner upgrade all remove controls from the denominator. Counting them as fixed would report a collection failure as progress.
Persistent, not closed, when resources change
A control failing in both assessments stays persistent even if the specific resources changed. A different set of failing resources is not evidence that the original problem was solved.
How it is computed
From two stored measurements, never inferred from the current assessment alone.
What it does not mean
Closed means the control was evaluated and passed. It does not mean the underlying risk was accepted, transferred or otherwise addressed by any route other than the control now passing.