The three possible assessment findings for a security requirement objective are MET, NOT MET, and NOT APPLICABLE (N/A). MET means the objective is satisfied, NOT MET means one or more objectives of the security requirement are not satisfied, and N/A means the security requirement and/or objective do not apply at the time of the assessment.