Evidence & Findings
Unclassified controls
A control the mapping does not cover is reported as unclassified rather than given the nearest-looking meaning, and coverage is published.
The no-invention rule
A control that matches nothing in the mapping is reported as unclassified. It is never given the nearest-looking interpretation, never assigned by the AWS service it happens to belong to, and never quietly folded into a neighbouring category to raise the coverage figure.
What an unclassified control still gets
Everything factual:
- the control identifier and its title
- its severity
- the resources it failed on, and their regions
- its place in the register and in the complete control index
What it does not get is a sentence claiming to know what it means.
Why this is the right default
The alternative is to guess. A guessed governance implication is indistinguishable, on the page, from one the mapping actually states, and a board cannot tell which it is reading.
Reporting the gap costs a line of coverage. Filling it with an invention costs the credibility of every other line.
Coverage is published
The mapping's coverage across the material findings is printed in the pack. Below a 90 per cent floor, the pack states in its assessment note that the governance commentary should not be read as a complete summary of material findings.
That is a disclosure threshold, not a delivery gate. The scanner catalogue grows, so an unmapped control is an expected condition and must never block a customer's assessment.