Assurance

Assurance is evidence that a security claim is actually true, and different kinds of evidence carry different weight.

Somebody saying it is true is the weakest. A document describing it is next. A configuration export is better. A test that demonstrates it working is better still, and an independent party doing that test is the strongest. Most assurance programmes collect the first two and report them as though they were the last two.