Theory
Unknown is red
If nobody can show that a control works, score it as failing. Amber and blank let an untested control sit quietly beside a tested one.
The observation
Claim: observation
Security reporting almost always has a not assessed category, and it is almost always the largest one. Because it is neither green nor red, it receives no attention and no budget, and it accumulates.
Treating unknown as red changes the conversation immediately. The first reaction is usually that the board will panic. The second, after a quarter, is that the organisation now knows which controls it has actually verified.
The cost
Claim: inference
This rule has a real cost. Verification is expensive, and some controls are hard to test in production. An untested control may still help, but the organisation cannot claim that it works.