Every status value across controls, evidence, policies, risks, vendors, findings, audits, training, privacy, integrations, and jobs, with the label the app shows.

Each table lists the stored value, the label the app shows, what it means, and who or what sets it. Stored values are what the REST API and MCP tools return and accept in filters; labels are what you see in the UI.

Compliance

Controls

The status picker offers the first five. planned, archived, and inferred can appear on records but cannot be chosen by hand.

Status	Meaning	Set by
Not Implemented`not_implemented`	No work started; the control counts against coverage.	You, Cortex, or a sync (inferred)
In Progress`in_progress`	Work is under way, or a link partially enabled the control.	You, Cortex, or the linking path
Implemented`implemented`	Operating and fully covered; counts toward coverage.	You, or the coverage check at 100 percent
Pending Review`pending_review`	Needs a look. Set when coverage drops below 100 on an implemented control, or when linking fully enabled it.	Coverage check or linking path
Not Applicable`not_applicable`	Excluded from scope; ignored by coverage.	You
Planned`planned`	Scheduled but not started. Not offered in the picker.	Sync or import
Archived`archived`	Retired control kept for history. Not offered in the picker.	Framework change
AI Inferred`inferred`	Status derived from evidence rather than asserted by a person.	Cortex or a sync

Evidence

Status	Meaning	Set by
Pending Review`pending_review`	Default on creation; does not count toward coverage until a person marks it valid.	You or a sync
Valid`valid`	Accepted; counts toward every requirement it is linked to.	You
Expired`expired`	No longer counts. Statistics also treat any row past its expiry date as expired, but only privacy evidence has its status rewritten automatically.	You; an automatic expiry check (privacy evidence only)

Policies

Status	Meaning	Set by
Draft`draft`	Being written; not shown to staff for acknowledgement.	You or Cortex
Review`review`	Waiting for the approver.	You
Approved`approved`	Current version in force; counts toward linked controls.	The approver
Archived`archived`	Retired; kept for history and no longer counts.	You

Tasks

Tasks have no status of their own. A task's status is the status of the control, evidence item, policy, risk, or finding it points at, so the values above and below are what you will see on the Tasks page.

Risk and security

Risks

Status	Meaning	Set by
Identified`identified`	Logged, not yet analysed.	You, Cortex, or a sync
Assessing`assessing`	Likelihood and impact being scored.	You
Mitigating`mitigating`	Treatments in progress.	You
Monitoring`monitoring`	Treated; watching residual risk.	You
Resolved`resolved`	Closed; the risk no longer applies.	You
Accepted`accepted`	Consciously accepted without further treatment.	You
AI Inferred`ai_inferred`	Proposed by Cortex or a privacy assessment and not yet confirmed by a person.	Cortex

Likelihood values are rare, unlikely, possible, likely, certain; impact values are negligible, minor, moderate, major, catastrophic.

Risk treatments

Treatment types are avoid, transfer, mitigate, and accept.

Status	Meaning	Set by
Planned`planned`	Agreed, not started.	You or Cortex
In Progress`in_progress`	Being carried out.	You
Completed`completed`	Done; feeds residual risk.	You
Cancelled`cancelled`	Abandoned.	You

Security findings

Severity is critical, high, medium, or low. Category is identity_access (Identity Access), vulnerability, configuration, compliance, or endpoint_posture (Endpoint Posture). Origin is manual or integration_scan.

Status	Meaning	Set by
Open`open`	Reported and unresolved.	You or a scanner sync
In Progress`in_progress`	Being fixed.	You
Resolved`resolved`	Fixed; a re-scan may reopen it.	You or a scanner sync
Accepted`accepted`	Risk accepted; stays visible.	You
False Positive`false_positive`	Not a real issue.	You

Certificates

Certificates show expiry flags computed at scan time rather than a status. See Certificates.

Vendors

Vendor assessment

Status	Meaning	Set by
Not Assessed`not_assessed`	No assessment recorded yet.	Default on creation
In Progress`in_progress`	Questionnaire sent or review under way.	You or the automatic assessment
Assessed`assessed`	Assessment complete for this cycle.	You or the automatic assessment

Vendor DPA

Status	Meaning	Set by
Not Applicable`not_applicable`	No personal data processed; no DPA needed.	You
Not Required`not_required`	Personal data involved but a DPA is not required for this relationship.	You
Pending`pending`	A DPA is needed and not yet signed.	You
In Place`in_place`	Signed DPA on file.	You
Needs Review`needs_review`	The DPA exists but something changed.	You or the automatic assessment

Questionnaire assignments

Per-question review states are pending (Pending Review), approved, needs_clarification (Needs Clarification), and rejected.

Status	Meaning	Set by
Pending`pending`	Sent; the vendor has not opened it.	You
In Progress`in_progress`	The vendor has started answering.	The vendor
Submitted`submitted`	All answers in; waiting for your review.	The vendor
Reviewed`reviewed`	You have reviewed every answer.	You
Expired`expired`	The link lapsed before submission.	Automatic expiry

People

Personnel

Status	Meaning	Set by
Active`active`	Current member of staff.	You or an HR sync
Inactive`inactive`	Left or offboarded.	You or an HR sync
Inconsistent`inconsistent`	Connected identity sources disagree about this person.	Directory reconciliation
Deleted`deleted`	Removed from the directory; kept for history.	You

Training plans

Status	Meaning	Set by
Draft`draft`	Being set up; no campaigns run.	You
Active`active`	Campaigns are generated from it.	You
Archived`archived`	Retired.	You

Training campaigns

Status	Meaning	Set by
Upcoming`upcoming`	Scheduled; assignments not yet sent.	Plan schedule
Active`active`	Assignments out; people can complete them.	Plan schedule
Completed`completed`	The window closed.	Plan schedule or you
Archived`archived`	Hidden from the list.	You

Training assignments

Delivery of the assignment email is tracked separately from the assignment itself, and an acknowledgement records whether it was given through an emailed link or while signed in.

Status	Meaning	Set by
Pending`pending`	Assigned; not opened.	Campaign
In Progress`in_progress`	Opened; not finished.	The person
Completed`completed`	Attested or recorded manually.	The person or you
Overdue`overdue`	Past the due date and not completed.	Automatic status update
Cancelled`cancelled`	Withdrawn.	You

Audit

Internal audits

Audit types are full, focused, and follow_up. The report inside an audit is draft or finalized.

Status	Meaning	Set by
Draft`planned`	Scoped; testing not started.	You
In Progress`in_progress`	Controls being tested.	You
Under Review`review`	Testing done; report being reviewed.	You
Finalised`completed`	Report finalised; read-only.	You
Cancelled`cancelled`	Abandoned.	You

Internal audit findings

Finding types are non_conformity, observation, and opportunity; severities are critical, major, and minor. Labels are shown in sentence case.

Status	Meaning	Set by
Open`open`	Raised; no remediation yet.	The auditor
In remediation`in_remediation`	Being fixed.	You
Closed`closed`	Remediation reported complete.	You
Verified`verified`	Closure confirmed by the auditor.	The auditor

Privacy

Privacy data sources

A data source is of kind datamap or ai_inventory.

Status	Meaning	Set by
Active`active`	Receiving pushes; its records are current.	Ingestion
Stale`stale`	No push for longer than expected.	Staleness check
Archived`archived`	Retired; records kept.	You

Processing activities

Source is derived (materialised from a manifest) or manual.

Status	Meaning	Set by
Derived`derived`	Materialised from a pushed manifest and not yet reviewed.	Ingestion
In review`in_review`	Being completed or checked by a person.	You
Approved`approved`	Confirmed; appears in the RoPA.	You

Privacy assessments

Outcomes are proceed, proceed_with_mitigations, consult_authority, and abandoned. Triggers are new_special_category, new_cross_border, signal_based, and manual.

Status	Meaning	Set by
Open`open`	Created; not started.	You or a trigger
In progress`in_progress`	Being filled in.	You
Completed`completed`	Outcome recorded.	You

Drift findings

Status	Meaning	Set by
Open`open`	A scan or connector disagrees with the approved record.	Drift detector
Confirmed`confirmed`	You agreed the record must change.	You
Dismissed`dismissed`	Not a real change.	You
Resolved`resolved`	The record was updated.	You

AI suggestions

Status	Meaning	Set by
Suggested`suggested`	Cortex proposed a value; nothing changed yet.	Cortex
Accepted`accepted`	Applied to the record.	You
Dismissed`dismissed`	Rejected.	You

Privacy monitors and scans

Status	Meaning	Set by
Active`active`	Monitor scans on schedule.	You
Paused`paused`	Monitor kept; no scans.	You
Pending`pending`	Scan queued.	Noru
Running`running`	Scan in progress.	Noru
Completed`completed`	Scan finished; results stored.	Noru
Failed`failed`	Scan could not finish.	Noru

Platform

Integrations

Sync log entries are success, error, partial, or in_progress.

Status	Meaning	Set by
Connected`connected`	Credentials valid; syncs run on schedule.	Sync
Syncing`syncing`	A sync is running now.	Sync
Error`error`	The last sync failed; check the log.	Sync
Disconnected`disconnected`	Credentials removed or revoked; no syncs.	You or the provider

Jobs

Priority is low, normal, high, or urgent. The app shows progress phrases such as "Processing..." and "Retrying..." rather than raw values.

Status	Meaning	Set by
Pending`pending`	Queued; not started yet.	Noru
Running`running`	In progress now.	Noru
Retrying...`retrying`	Failed once; will run again automatically.	Noru
Completed`completed`	Finished.	Noru
Failed`failed`	Gave up after retrying.	Noru
Cancelled`cancelled`	Stopped before completion.	You or Noru

Statuses