The six verification states
Every control lands in one of six proof states, from Verified down to Missing, based on the evidence behind its capabilities.
Last updated September 22, 2026
Evidence classifies every control into one of six states, based on the strongest proof held by the capabilities that control depends on. The states are a proof axis, entirely separate from framework readiness.
The states
Verified. Fresh, independent evidence backs the control. This is the strongest state and the basis for your program coverage number.
Provisional. Attested or partial. The control is covered by CAMP answers and/or partial or self-attested evidence, but not independently proven.
Needs review. There is contradicting evidence and no fresh support to outweigh it.
Conflicting. An unresolved yes-versus-no conflict in the evidence that must be reconciled.
Stale. The only supporting evidence has fallen outside its freshness window and needs refreshing.
Missing. No evidence touches any contributing capability yet.
How a state is chosen
The classification is deterministic and follows a fixed priority. A conflict outranks everything, then contradiction, then staleness, then fresh support, then partial or self-attested support, and finally the absence of anything. Evidence is aggregated to the capability level and the control takes the strongest proof its capabilities carry.
Crucially, a self-reported CAMP answer on its own never earns Verified or Provisional on the strength of the report alone. The claim is not the proof.
Work the flag states first: Conflicting and Needs review point at evidence that disagrees with itself. Resolving those sharpens your picture faster than chasing Missing.
The documents and requests that move controls between these states live in the Evidence library, fed by evidence intake.