Skip to content

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everythingK

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Four ways a green check lies

The empty result, the adjacent claim, the vacuous pass and the dashboard: four collector failure modes that read as passing, each presented as a verdict for you to call before the reveal.

Rendered from FedRAMP Consolidated Rules for 2026 version 2026.07.14.01

Four collectors follow. Each one is green: the job succeeded, the output is tidy, the dashboard is calm. Your task is the verdict an assessor would reach — and each of these failure modes has shipped in the wild, which is why they have names. Call each one before reading on.

Trap 1 of 4The empty result

Your collector queries a compliance rule for NON_COMPLIANT resources and returns an empty list. The job exits zero and the dashboard tile goes green.

Is the empty list evidence that everything complies?

Exit check — name three reasons a green check can be wrong.

Any three of the four: the empty result (nothing found is indistinguishable from nothing ran), the adjacent claim (related subject matter filed as a join), the vacuous pass (a check over an empty population), and the dashboard (a rendering standing in for its source, logic, coverage and failure path). If you can also say what each collector must additionally prove — that it ran, what it evaluated, and what it claims for exactly — the step held.