Controls
Control severity
The scanner's judgement of a check in the abstract, used as a scoring weight and deliberately not used as a measure of reach.
Currentengine 9.0.0Verified 2026-08-30
What it is
Critical, high or medium. Assigned by the scanner, identical for every customer in the world.
How GovIntel uses it
| Severity | Weight |
|---|---|
| Critical | 10 |
| High | 6 |
| Medium | 3 |
| Low | 1, retained for completeness and never applied |
It also drives the critical ceiling, and it is one input to a materiality escalation for preventive, externally reachable controls.
What is never collected
Low and informational. The scan is invoked at three severities only, so those cannot appear in a pack and cannot affect a score.
What it does not mean
Severity is not materiality. It says nothing about how far a failure reaches in your account, which is computed separately from observed resources, regions and scope.