Findings
Resource reach
How much of an account a single control failure touches, measured from distinct resources, region spread and whether the control is account-scoped.
What it is
The observed extent of a failure: how many distinct resources failed, whether those failures span more than one region, and whether the control governs the account as a whole.
Why it is measured separately from severity
Severity is assigned to the check in the abstract. Reach is a property of this account. A medium control failing on forty resources across five regions reaches further than a critical failing on one.
How GovIntel computes it
From the resources deduplication retained, and from whether the mapping declares the control account-scoped. Account-scoped controls reach everything, whatever their nominal resource count: a root-account or organisation-wide control fails on one notional resource and touches the whole estate.
When it cannot be determined
Where the evidence carried no resource identifier, reach is reported as not determinable. It is not guessed at, and the control is still reported in full.
What it does not mean
Reach is not consequence. It says how far, not how much it matters to your business.