It is an applicable requirement without adequate evidence that the implementation meets it. Add the needed stimulus/checker/evidence, remove it from scope with a justified applicability decision, or record an approved waiver and residual risk. A waiver makes the gap explicit; it does not verify the requirement. Coverage percentage alone cannot reveal this—requirement traceability and evidence review can.

Common trap: Closing coverage % without requirement trace.