Findings
Failed control
A control the scanner evaluated and found not satisfied. It is the unit of a finding, and it counts once however many resources it failed on.
What it is
A control that was evaluated and did not pass, on at least one resource.
How it is reported
Once, carrying every resource it failed on, its severity, its governance implication where the mapping covers it, its materiality band, and a closure test.
Where it appears
In the narrative risk register if it ranks high enough, and in the complete control index always. The index carries every failed control at every severity, so the capped register plus the index always account for the full count.
What it does not mean
A failed control is not an incident, not a breach, and not evidence that anything has been exploited. It is a configuration state that does not satisfy a check.