An Unknown compliance result is not the same as a failed compliance result.
Unknown means remFREE does not currently have enough reliable evidence to determine whether the control passes or fails.
That distinction is intentional.
Why not just mark it failed?
Because failure is a factual claim.
If the endpoint clearly reports that a required protection is disabled, remFREE can reasonably report a failure.
If the endpoint instead reports an error while trying to collect that information, remFREE knows something different:
The result could not be determined.
Turning that into a failure would misrepresent the evidence.
Common reasons for Unknown
Unknown may occur when:
- a required command fails
- a service cannot be queried
- the operating system does not expose the expected information
- permissions prevent collection
- a provider returns incomplete data
- the endpoint disconnects during collection
- the result cannot be parsed reliably
- the platform does not support that evidence source on the endpoint
Unknown still deserves attention
Unknown should not be ignored.
The important question becomes:
Why could remFREE not determine this control?
Investigate the evidence and source job.
Review the compliance detail
Where available, look for:
- detected value
- expected value
- evidence
- source job
- error information
This may immediately explain why the control could not be evaluated.
Check the source job
If the compliance result came from an endpoint job, open that job.
Determine whether the agent successfully executed the collection operation.
A communication or execution error can explain the Unknown result.
Confirm platform support
Some compliance checks may depend on operating-system-specific capabilities.
A check designed for Windows should not be assumed to produce meaningful results on Linux, and vice versa.
Re-scan after correcting the problem
Once the collection problem has been resolved, run compliance again.
A new result can replace uncertainty with current evidence.
Why this matters
Good security reporting should distinguish between:
PASS
We have evidence the requirement is satisfied.
FAIL
We have evidence the requirement is not satisfied.
ATTENTION
We have evidence of a condition requiring review.
UNKNOWN
We do not have enough reliable evidence.
NOT SCANNED
We have not performed the required evaluation.
These states mean different things.
Keeping them separate makes remFREE's compliance results more trustworthy.