The three-state rule: verified, cannot prove, missing

The three-state rule: stop guessing what underwriters will infer

Cyber insurance evidence is not pass/fail. Mature submission packs classify every control theme into exactly one of three states:

• Verified — independent or read-only proof supports the claim
• Cannot prove — you believe the control is in place, but proof is incomplete, stale, or self-attested
• Missing — control absent, out of scope, or not operated as represented

This three-state rule exists because carriers already think in shades of gray. When you omit the middle bucket, you force underwriters to assume the worst — or to assume optimism. Both outcomes create renewal friction.

Callout: Never silently promote a row from Cannot prove to Verified because the narrative “sounds right.” Promotion requires new evidence, not new wording.

Why two-state thinking fails

Teams often sort controls into “we’re good” and “we’re bad.” That binary map breaks during technical review:

• MFA is “on,” but registration gaps remain on executive accounts
• EDR is licensed, but coverage counts do not match the employee census
• Backups run nightly, but restore tests lack tickets or sign-off
• DMARC exists, but policy is p=none without a staged plan

Each example is Cannot prove or Missing depending on scope — not a confident Verified. Binary sorting hides the remediation that would actually improve your submission.

Definitions in operational terms

Verified

Verified means an underwriter or their vendor can corroborate your statement without trusting a verbal assurance. Typical sources:

• Read-only identity exports (Conditional Access policies, MFA registration reports)
• DNS records for DMARC/SPF/DKIM shown in context
• EDR or backup vendor reports with dates, scopes, and coverage metrics
• Signed incident response tests or tabletop minutes with attendees listed

Verified does not mean “perfect security.” It means the claim is audit-ready for that theme.

Cannot prove

Cannot prove is the honest middle. Operations may be correct; documentation is weak. Examples:

• Policy says MFA required; no export shows enforcement rules
• MSP asserts patching; no report in the evidence index
• Training happens ad hoc; no completion roster

Cannot prove rows should name what artifact would upgrade the row — not vague promises.

Missing

Missing is non-negotiable gap: control not deployed, not licensed, or explicitly out of scope but answered “yes” on the form. Missing requires either remediation or correction of the application before bind.

How the three states flow through a renewal

1. Intake — broker sends carrier questionnaire themes.
2. Draft crosswalk — assign provisional states without ego.
3. Evidence pass — attach one primary artifact per theme where possible.
4. Human review — technical lead signs that statuses match attachments.
5. Submission — broker forwards indexed pack; underwriter asks follow-ups on Cannot prove and Missing only where material.

Skipping step four is how organizations re-learn the same lesson each renewal.

Relationship to scoring bands

Readiness scoring often uses red, amber, and green bands for prioritization. Do not equate green with all Verified. A green band can still contain Cannot prove rows on lower-weight themes. Conversely, a red band with honest Missing labels is more broker-friendly than a green band built on unchecked attestations.

Heat maps visualize priority; crosswalk states visualize defensibility. Use both.

Read-only verification and the middle state

Microsoft 365 and Google Workspace read-only ingestion can move identity-heavy themes from Cannot prove toward Verified when exports match production. It does not automatically verify endpoints, backups, or physical controls — those remain MSP/vendor evidence tasks.

When verification completes, statuses should be recomputed, not manually edited. Human sign-off confirms the mapping, not wishful thinking.

Broker and leadership communication

Brokers need language they can forward without translating IT jargon into risk fiction. A three-state summary paragraph prevents “everything is fine” emails that collapse under one underwriter question.

Suggested broker note pattern:

• Count of Verified themes with primary artifacts named
• Count of Cannot prove themes with planned upgrades dated
• Count of Missing themes with remediation owner

That transparency builds trust faster than a folder of unrelated screenshots.

Common anti-patterns

• Status laundering — renaming Missing as “planned Q4” without changing the state
• Artifact sprawl — twelve PDFs for MFA with no index row
• Stale proof — exports older than the carrier’s freshness window
• Scope mismatch — proving DMARC for marketing domain while payroll runs elsewhere

Each anti-pattern maps to a Cannot prove row until fixed.

Governance: who may change a status

Assign a single evidence owner (often IT lead or vCISO) who can move rows from Cannot prove to Verified. MSPs may supply artifacts, but they should not unilaterally mark themes Verified without your review — they rarely see the full application scope.

Document promotions in a change log: date, artifact filename, reviewer initials. During audits or claims, that log shows diligence rather than ad hoc checkbox edits.

Escalation when states disagree

Leadership, IT, and brokers sometimes disagree on labels. Rules of thumb:

• If production config contradicts the application, correct the application first
• If config is correct but proof is thin, keep Cannot prove until export lands
• If the control truly does not exist, mark Missing even when uncomfortable

Disputes resolved by downgrade protect the organization; disputes resolved by optimism create representation risk.

Teaching the vocabulary across the client

Finance, HR, and operations leaders influence controls (wire workflows, training, vendor onboarding) but may not know the three states. A fifteen-minute briefing prevents them from promising brokers “we’re fully verified” based on a green dashboard widget.

Share one example row per department: HR owns training completion; finance owns wire dual-control evidence; IT owns MFA exports.

Verify before you commit on the application

If your team has not walked through verification recently, use the guided fit check verification step to see which themes still rely on attestation alone. Pair that with the main fit check for prioritization.

Callout: Verification is a snapshot. Calendar a re-check before renewal if identity or endpoint scope changes materially.

Closing perspective

The three-state rule is a discipline, not branding. It aligns your team, your broker, and your underwriter on the same vocabulary. Verified rows earn speed; Cannot prove rows earn a plan; Missing rows earn honesty before bind. That combination reduces surprise and keeps post-incident comparisons closer to reality.

Learn how states appear in a full deliverable on sample report, or return to Cyber Ready for the full workflow overview.