Governance Concepts
Evidence confidence
A measure of how many governance domains were actually scored, and the gate that withholds an overall rating when too few were.
What it is
High, Moderate or Low, derived from the number of scored governance domains.
| Level | Requirement |
|---|---|
| High | 3 scored domains, security among them |
| Moderate | 2 scored domains |
| Low | Fewer than 2 |
Why it is measured this way
Because measuring it over collectors was wrong. Every collector could succeed while only two governance domains had been scored, and the assessment would still have claimed High confidence.
Account metadata and Security Hub status are context. They establish no governance position.
How GovIntel applies it
Below High, the overall rating is withheld and reported as insufficient evidence, and no deliverable pack is emitted.
What it does not mean
It is not confidence that the findings are correct. It is a measure of coverage, not of accuracy. Individual control results have not been independently audited.