Verdicts
Every check ends in one of five verdicts. A broken control is inconclusive, never a pass.
Each check returns one verdict. The verdicts feed the grade, which owns the scoring, the critical cap and advisory checks. The evidence under each one says how it was established.
The five verdicts#
| Verdict | Means |
|---|---|
| pass | The probe looked for the bad outcome and did not see it. |
| part | Partly clean: some tools or cases were clean, others were not, or a smaller problem was found. |
| fail | The bad outcome was seen. |
| inconclusive | The harness could not tell, so it does not guess. |
| n/a | The check does not apply to this server. |
How a verdict is reached#
Does the check apply? If not: n/a, with the reason.
Does the control pass? Before judging, the harness proves the tool can do what the probe needs, for example that a SQL tool can read the seed data. If the control fails: inconclusive. Never pass.
Did the probe see the bad outcome? No: pass. Partly: part. Yes: fail.
A broken connection must not look like a secure server. That is why step 2 exists.
Several SQL tools#
A db check runs once per workable SQL tool. All tools clean is pass, some clean is part, none clean is fail.