# Security assessment report document profile

The **Security assessment report** profile helps you index source-stated security findings. It belongs to the technical quality family.

## Recognize the source

Assessment or penetration test report; distinguish incident report. Do not infer exploitability or expose secrets in default columns.

Review the document itself before applying the profile. Similar labels, dates, parties, or amounts can appear in another document type with a different meaning. Use the source context to distinguish them.

## Expected fields

Core fields form the profile’s main structure. Recommended and optional fields add supported detail. None of these designations permits guessing a value that is absent or ambiguous.

| Field | Type | Inclusion | Meaning and extraction rule |
| --- | --- | --- | --- |
| Assessed system | text | Core | The source-stated assessed system for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |
| Assessment period | text | Core | The source-stated assessment period for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |
| Assessment scope | text | Core | The source-stated assessment scope for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |
| Findings excerpt | text | Core | The source-stated findings excerpt for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |
| Stated risk rating | text | Core | The source-stated risk rating for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |
| Methodology | text | Optional | The source-stated methodology for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |
| Limitations excerpt | text | Optional | The source-stated limitations excerpt for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |
| Recommendations excerpt | text | Optional | The source-stated recommendations excerpt for this document and its identified subject. Copy exact source spans for this one scalar field, preserving their order, ownership and qualifications. Ordered spans may continue across segments. Do not synthesize a summary or combine unrelated fields or repeated records; return unresolved when the scalar meaning is ambiguous. |

## Missing, ambiguous, and repeated values

Missing or ambiguous fields remain null with a reason. Null is not zero, false, an empty statement, or proof that a document-wide fact does not exist. Inspect unresolved states and their supporting passages before accepting the table.
This document type can contain repeated records such as **findings and remediation actions**. The profile uses one row per document; do not compress repeated records into a scalar field or confuse a line value with a document-level total.
Additional supported fields can be considered when the extraction experience allows them. Review their definitions and types explicitly; changing a field’s meaning requires a new extraction preview.

## Review the result

Select evidence-backed cells and read the retained source. Text should preserve the relevant source spans and qualifications. Numbers and dates must be stated unambiguously and normalized safely; do not calculate unstated values or infer missing units, currency, scale, date parts, or time zones.

Verify the result against the captured document before acceptance. Source support does not independently establish perfect OCR, exhaustive field discovery, or correct domain interpretation.

See [profile modes](/docs/documents/profiles), [table review](/docs/tables/review-and-accept), and [captured evidence](/docs/documents/citations-and-evidence).