Findings
First action
The single next step for a failed control, written so a director can direct it and an engineer can start it without further interpretation.
What it is
The first thing to do about a failed control, taken from the governance mapping alongside the implication.
Why one action and not a plan
A board pack that lists five options per finding transfers the decision back to the reader. One action is directable.
How GovIntel writes it
Per governance category rather than per control, and phrased as a constraint to apply rather than a setting to toggle: restrict the exposure, apply the lifecycle discipline, enable the protection on the reported resource.
Where an exception is legitimate, the action says so and asks for it to be recorded with who approved it and why, rather than pretending every finding must be closed.
What it does not mean
It is not a remediation runbook and not a command. GovIntel does not know your change process, your environments, or which resources are load-bearing.