The words behind the proof.

Terms

Automated control

A control whose status comes only from its latest check against a connected system. Nobody can set it by hand.

Manual control

A control a person attests. Venevor records who attested it and when, and shows it as asserted.

Verified

A system was read and the latest result proves the requirement, with a timestamp and a source you can open.

Asserted

A person says the requirement holds. Shown beside verified results and never counted as verified.

Exception

A known gap someone accepted, with an owner and an expiry date. It never changes an automated control's status.

Gap

The evidence shows the requirement is not met. It goes to the top of the list.

Unknown

No source can check the requirement, or its evidence went stale. Shown as unknown, never as fine.

Check

One automated reading of one system, for example "MFA is enforced in Okta". Each result is timestamped and kept.

Crosswalk

The mapping from one check to the requirements it supports in every framework, so evidence is collected once.

Evidence freshness

How recent a piece of evidence is: never collected, collecting, fresh, stale, failed, or cannot verify.

Readiness

A framework's requirements rolled up from their controls, with verified and asserted shown separately.

Exposure Score

A 0–1,000 score of risk exposure for an asset, a business entity or the whole organization, with its method shown and a daily history.

Business entity

A part of your organization, such as a subsidiary or business unit, that assets belong to. Exposure rolls up per entity.

FAIR

Factor Analysis of Information Risk, a model for estimating loss in money. Venevor runs it as a reproducible Monte Carlo simulation.

KEV and EPSS

CISA's Known Exploited Vulnerabilities catalog and the Exploit Prediction Scoring System. Venevor uses both to rank what to fix first.

OSCAL

NIST's machine-readable format for security controls and assessment results. Venevor imports catalogs and exports assessment results in it.