Technical Concepts
Scanner
The external tool producing control results. Its version and severity scope are published methodology, not an implementation detail.
What it is
Prowler, pinned at a specific version, invoked across every enabled region at critical, high and medium severity.
Why the version is part of the methodology
An upgrade changes which checks exist, which changes the denominator of the pass rate, which changes every customer's score, silently, with nothing failing.
Pinning it and recording it in a contract file makes a bump a deliberate change with a reviewer looking at the scoring consequence.
What GovIntel does and does not take from it
Taken: the control results, their status, severity, identifiers and resources.
Not taken: its remediation text, its compliance framework annotations, and its own product fields. GovIntel's governance interpretation comes from a version-controlled mapping of its own.
The ceiling it sets
A control the scanner does not implement is a control the assessment cannot report. Security coverage is bounded by its catalogue.
What it does not mean
GovIntel does not resell the scanner's output. The scoring, gating, interpretation, materiality and disclosure are GovIntel's.