RE: Difference between a non-compliant system and untrusted system
to me, a non-compliant system is one whereby you trust that system, but the products on it aint up to your benchmark. eg. your environment is using vse8.7i, but this machine is still on vse8.0i, you'd consider this machine to be non-compliant and you'd probably do something about it.
an untrusted machine would have been one that werent even installed with your company's designated products. this machine could well be an entirely newly purchased system which is yet to be properly setup. it could also be a machine belonging to an external visitor to your environment.
I'd add to Galantico's response that if a system is using the right version of, say VSE, but is (outrageously) out of date with DAT (like a few weeks/months late, or anything more than 50 DAT "numbers" old) I'd consider it as definitely non-compliant but probably also untrusted.