Controls
Scanner contract
The pinned scanner version and severity scope, treated as published methodology because changing either changes every score at once.
What it is
The record of which scanner produces control evidence, at which version, and at which severities.
| Term | Value |
|---|---|
| Scanner | Prowler |
| Version | 5.37.1, pinned |
| Severities collected | critical, high, medium |
| Severities excluded | low, informational |
Why it is a contract rather than a dependency
An upgrade changes which checks exist, which changes the denominator of the pass rate, which changes every customer's score, silently, with no test failing.
Recording the version in a contract file and pinning it in the dependency set makes a scanner bump a deliberate two-file change with a reviewer looking at the scoring consequence. A test fails if the two drift apart.
How GovIntel applies it
The contract also records the mapping version, so a delivered pack can be traced to the wording that produced it.
What it does not mean
The contract does not make the scanner GovIntel's. Its catalogue is the ceiling on security coverage, and a control it does not implement cannot be reported.