Direct answer
A retest is inconclusive when the assessor cannot establish whether the original condition is fixed under comparable conditions. Record the obstacle, evidence and next action; do not convert an unavailable or blocked check into a passing result.
Check the test prerequisites
Confirm the environment, deployed version, test accounts, fixture ownership and original route. If a test account is locked out, the request may fail before the authorization decision is reached. An expired session or missing test record can have the same effect.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Use comparable controls
For an original cross-tenant read issue, repeat the allowed same-owner read and the forbidden other-owner read with safe records. If neither works, investigate the session and fixture before claiming the authorization fix is effective.
- Record the exact failure and collection time.
- Document changes in environment, role or network path.
- Keep the original finding and retest evidence separate.
Assign a status and next step
Use the organization's agreed status vocabulary: fixed, still present or inconclusive. An inconclusive result should include the missing access or evidence, an owner and a plan to repeat the relevant check. A temporary protective block can reduce exposure but is not automatically proof that the underlying flaw was fixed.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Close only the tested question
After prerequisites are restored, repeat the agreed verification and positive controls. Describe the tested version and boundary. A fix on one route does not establish that related exports, batch APIs or other environments were tested.
Assessment limits
A retest is limited to the specified findings and conditions. An inaccessible target or different deployment prevents a reliable comparison with the original test.
Frequently asked questions
Is a 403 response always proof of a fix?
No. Confirm that the expected legitimate control works and that the denial occurs at the intended authorization boundary.
Can a retest cover an entire application?
A focused retest covers agreed findings and regression paths. A broader reassessment needs separate scope.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.