Capture status is separate
Complete, Incomplete and Unavailable describe licence-assignment capture separately from rendered evidence state.
Evidence & Coverage
Know what the evidence supports — and where it stops.
This page documents the evidence contract behind the simpler customer-facing claims elsewhere on the site. Source provenance, availability, completeness, Coverage, rendered evidence state and licence-assignment capture status remain separate so missing evidence never becomes a clean conclusion.
Release-status boundary
Claims remain bounded to reviewed evidence
Selected observed-zero, unavailable-source and scanner-failure paths have automated-test and controlled runtime evidence in a reviewed Salesforce environment. Running-user sharing, CRUD, field-level security and environment compatibility remain separate validation questions for the release build and target environment. Public package installation is not yet claimed.
Evidence detail levels
Three retention levels, one assessed scope
Top Issues, Balanced and Everything change what safe detail is retained, displayed, compared and exported; the selected level does not redefine the assessed source scope. Everything is the deepest supported level, not exhaustive or unlimited.
Licence-assignment retention
Capacity, holdings and retained identities stay separate
Top Issues retains no licence-assignment rows or assignment-summary rows; the omitted assignment detail is Not retained at this evidence level. Balanced retains holding summaries only; individual assignment identities are Not captured. Everything performs bounded assignment capture for Package Licences, Permission Set Licences and Salesforce User Licences, retaining up to 1,000 rows per family. The theoretical maximum is 3,000 retained rows per scan across those three families, not an organisation total. Actual safe capture can be lower because Salesforce transaction and DML headroom must be preserved.
Zero captured is not zero assignments
An incomplete capture can contain fewer rows than expected or zero rows. It must not be shown as Complete, and an unknown expected count remains unknown.
Retention remains bounded
Capacity totals and holding summaries remain distinct from capped assignment identities and from the selected evidence detail level.
Evidence boundary
Missing evidence must never become a clean result.
When an evidence source cannot be assessed, Security Observatory preserves that limitation explicitly. It does not convert unavailable evidence into a zero count, clean state or unsupported assurance claim.
Evidence terminology
One canonical rendered vocabulary
The rendered state is selected according to the limiting evidence dimension. Partial is a completeness qualifier, not a separate state. Coverage remains a separate axis for supporting-framework review. A retained state is the point-in-time rendered state stored with a scan.
Severity
- Critical
- High
- Moderate
Rendered evidence state
- Contextual metric or finding label
- None found
- Unavailable
- Not assessed
- Not retained at this evidence level
- Not captured
- Not applicable
Coverage
- Automated
- Partial Evidence
- Manual Required
- Not Covered
- Extended Check
- Partial Evidence is Coverage, never an outcome or evidence state
Completeness boundaries
- Partial: shown beside a usable count
- Not assessed: work not performed or outside assessed scope
- Unavailable: required attempted source inaccessible or unusable
- Not retained at this evidence level: detail intentionally not retained
- Not captured: product intentionally does not capture that detail
- Incomplete: separate licence-assignment capture status for bounded or truncated capture
Licence-assignment capture status
- Complete
- Incomplete — the full population could not be retained safely
- Unavailable
- Captured may be lower than expected or zero when safe transaction/DML headroom is exhausted
- Zero captured is not zero assignments and must not be shown as Complete
- An unknown expected count remains unknown
Read this before drawing conclusions
What a result does not mean
- Not a compliance decision. A Security Benchmark for Salesforce (SBS) control reference is a version-bound pointer to retained evidence, not a statement that the control is satisfied, compliant, certified, secure or passed.
- None found is not a pass. It means no matching records were observed in the successfully assessed scope — not that the control passed or that exposure cannot exist outside the assessed sources.
- Unavailable is not zero. When a required source was attempted but could not be obtained or used, the result remains Unavailable and carries a bounded reason and safe next action where available.
- History is not rewritten. A later terminology, SBS registry or mapping change does not silently reinterpret retained historical evidence.
- Counts are family-scoped. A retained family finding count belongs to the mapped scanner family, not uniquely to one SBS control.
SBS boundary
What a Security Benchmark for Salesforce control reference means
SBS is an independent project, not a Salesforce product or a Fortmilo benchmark, and it is not endorsed or supported by Salesforce. Control references are version-bound pointers to retained evidence. They are not statements that a control is satisfied, compliant, certified, secure or passed. Where human judgement is required or a source is unsupported, Manual Required or Not Covered remains explicit as applicable.
SBS material is attributed under CC BY-SA 4.0; Security Observatory identifies the referenced source/version and any mapping modifications.
Separate from evidence detail
Coverage type describes how far available evidence can assess the mapped question. It is neither confidence nor the selected evidence detail level.
Separate from outcome
Coverage tiles, including Partial Evidence, remain separate from control-outcome tiles and filters.
Bounded attribution
SBS remains independent from Salesforce and Fortmilo; the mapping records source, version and modification context.
Export controls
Each surface exports a fixed allow-list
There is no universal retained-evidence CSV schema. Each evidence surface exports an allow-listed subset of display fields, and the browser download creates a separate boundary outside Salesforce.
Governance export is a subset
The asset and governance CSV does not export the complete governance record. Review the governed record in Salesforce for supported ownership, purpose and review context.
Spreadsheet formula-trigger mitigation
In the reviewed JavaScript export helper, every header and cell is quoted, embedded quotes are doubled, and tabs, carriage returns and line feeds are flattened to spaces. If a cell begins with =, +, - or @, an apostrophe is prefixed. This is bounded to the reviewed helper paths and enumerated trigger characters.
Sensitive-value boundary
Helper-backed exports sanitise prohibited sensitive-value labels and IP literals. Observatory-retained and exported evidence contains no token values, session IDs, secrets, certificate bodies or raw IPs.
Retained-history boundary
Historical evidence is bounded and interpreted in context
Free V1 retains 1–10 completed scans. Review remains bounded to the same source Salesforce organisation and like evidence levels; a later terminology change does not silently rewrite retained historical evidence.
Evidence detail level
Top Issues, Balanced and Everything describe retained detail and must not be treated as interchangeable.
History is not indefinite
Current defaults are Developer Edition 1, Sandbox 3 and Production 3 retained completed scans.
History is not rewritten
A terminology-contract change does not by itself reinterpret evidence retained by an earlier scan.