Unconfirmed explained
Security assessment findings: reported versus confirmed
A questionnaire answer records what you report. Confirmation records an assessor’s review against evidence; it is separate from saving an answer or approving a document.
Answer versus finding
One answer may inform several mapped requirements. UpCISO records client answers as unconfirmed. A mapping describes coverage and does not demonstrate that any requirement is met.
Review the evidence
An assessor reviews the applicable criteria, records the result and its rationale, and confirms the finding only when supported. Missing evidence or an incomplete answer should remain visible as unfinished work.
Next step
Open Assessment, select the correct framework, and review individual requirements. Document approval, task completion and assessment confirmation are separate actions with different meanings.