What it means
Uncertainty is the gap between the facts you have and the facts needed for a sound decision. You may not know whether a system is exposed, whether a control works, or whether a suspicious event caused harm. Writing these gaps down prevents assumptions from quietly becoming conclusions.
Not every unknown deserves the same investigation effort. Focus first on information that could change the response or priority. Distinguish an unknown fact from an estimate with a range of possible values. You can make a proportionate decision before every question is answered, provided its assumptions and limits remain clear.
The idea at a glance / Risk
Keep unknowns out of the fact column.
The record names an account and time. Human identity, travel, and application access remain unresolved; assigned checks are not results.
Fictional clinic case U12, 25 September 2026 at 09:00 UTC. L91 reports the CL-6 sign-in at 08:42. Application activity has not been obtained.
READ THE PICTURE
Read the evidence and limits
L91 reports a sign-in, not who operated CL-6 or what they accessed. Missing application records leave patient access unresolved. Noor’s checks are assigned; the current note proves neither disclosure nor safety.
Keep in mindThis is one incomplete case note. No account-owner reply, application search result, confirmed disclosure, verified safety, or completed containment action is shown.
Read the complete example
- Read the evidence and limits. L91 reports a sign-in, not who operated CL-6 or what they accessed. Missing application records leave patient access unresolved. Noor’s checks are assigned; the current note proves neither disclosure nor safety. At 09:00 UTC on 25 September 2026, analyst Noor has identity-provider record L91 reporting a successful sign-in for clinic account CL-6 at 08:42. This record is the observed source for the account, time, and provider-reported result. Its existence alone does not establish who controlled the account, whether the employee traveled, whether the account was misused, or what happened in the application. The account owner has not yet replied through a trusted contact route. The application activity source has not been obtained; this is a collection gap, not a searched dataset with zero matching events. Whether patient records were opened or copied therefore remains unresolved. Noor records two unfinished checks due at 09:15: contact the account owner through stored trusted details, and obtain the relevant application activity with its time range and collection coverage. Assignment is not evidence that either check succeeded. This drawing does not invent a negative result, resolve the case, or show a completed containment action. The current note can cite L91 and explain the questions that still affect the interpretation, but it supports neither a confirmed patient-data disclosure nor a claim that the account was safe. A subsequent review should record the actual response, search scope, missing records, and how new evidence changes the decision.
This is one incomplete case note. No account-owner reply, application search result, confirmed disclosure, verified safety, or completed containment action is shown.
Diagram references: NIST SP 800-30 Rev. 1 - risk factors, assumptions and assessment limits · NIST SP 800-61 Rev. 3 - DE.AE adverse-event analysis and incident criteria
AN ILLUSTRATIVE SCENARIO
A clinic account alert
A clinic receives an alert about a staff account signing in from an unusual location. The analyst knows the time and account name but has not confirmed whether the employee traveled, whether the address represents a shared network, or whether patient records were opened. The analyst writes those questions explicitly, contacts the account owner through a trusted channel, and checks application activity. Until that evidence arrives, the alert remains suspicious activity requiring investigation, rather than a confirmed disclosure.
Put it to work
- Separate observed facts, interpretations, and missing information in the case note or risk record so another reader can distinguish them.
- Prioritize unknowns that could change the decision; assign each an owner, a source to check, and an appropriate deadline.
- State what you will do while information is incomplete, why that action is proportionate, and when you will revisit it.
How to check your work
Review the final note for unsupported certainty. It should explain which unknowns were resolved, which remain, and how the remaining gaps affect confidence and the next action.
Connect the ideas
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
- False positive
An alert that did not represent the harmful event the detector was meant to catch.