The four statuses
Set each control using the dropdown on its row:
- Not started — no work done yet. Honest and fine.
- In progress — partially implemented. Counts for 40% of a control's weight in your score.
- Implemented — done, and you could show a reviewer how. Counts fully.
- N/A — genuinely doesn't apply. Removed from your denominator entirely.
Use N/A carefully
N/A removes the control from your score rather than penalising you, which makes it tempting. A reviewer reading your trust page will notice if half your Security pillar is N/A. Only use it where the control is structurally inapplicable — not where it's inconvenient.
Evidence badges
Controls that adversarial tests map to show a badge like evidence 2/2 passing. This comes from your latest evidence run, not from anything you typed. See Where evidence comes from.
Contested controls
If you mark a control implemented but your latest test run has failures mapped to it, Veriflow flags it contested and shows it in red on the Overview.
A contested control scores below "in progress" — 20% versus 40%. That is deliberate. Claiming a control works while your own tests say otherwise is worse than admitting it's incomplete, because a reviewer who spots it stops trusting everything else on the page.
To clear it: fix the failure and re-run your tests, or set the control back to in progress.