Controls
Unclassified control
A failed control the governance mapping does not cover. It is reported in full and given no interpretation, rather than the nearest-looking one.
What it is
A failed control that matched no entry in the governance mapping.
What it still gets
Everything factual: the identifier, the title, the severity, the resources it failed on and their regions, and a place in the register and the complete control index.
What it does not get
A sentence claiming to know what it means. The no-invention rule is explicit: a control that matches nothing is never given the nearest-looking interpretation, never assigned by the AWS service it belongs to, and never folded into a neighbouring category to raise coverage.
Why this is right
A guessed governance implication is indistinguishable on the page from one the mapping actually states, and a reader cannot tell which they are reading.
The coverage floor
Mapping coverage across material findings is published. Below 90 per cent, the pack states that its governance commentary should not be read as a complete summary of material findings.
That is a disclosure threshold, not a delivery gate. The scanner catalogue grows, so an unmapped control is expected and must never block an assessment.