A security dashboard reports no findings for a resource type that the configured rules do not support. How should the result be represented?

1. As automatically protected by every rule in every Region.
2. As unassessed coverage, with another suitable control or explicit risk handling required.
3. Remove the resource from inventory so coverage appears complete.
4. As proven compliant because the dashboard contains no red entries.