Records a vulnerability that cannot be remediated in time, or whose risk is kept temporarily by decision: justification, residual risk, compensating controls, conditions, monitoring and expiry. The service prepares the file: only the authorised person accepts the risk, and the decision is theirs to record.
Contents
1. Document Information
2. Exception Identification
3. Vulnerability Description
4. Affected Asset
5. Technical and Business Context
6. Exception Justification
7. Risk Assessment
8. Potential Business Impact
9. Existing Mitigations
10. Residual Risk Assessment
11. Compensating Controls
12. Risk Acceptance Conditions
13. Monitoring Requirements
14. Review and Expiration Date
15. Risk Owner
16. Approval and Sign-off
17. Exception History
What you provide
Deliverable — You set its title, author and structure.
Exception — Who asks, for which vulnerability.
Vulnerability — Filled from a selected register when left empty.
Justification — Why it cannot be fixed now.
Risk assessment — As assessed by those who know the asset.
Acceptance and monitoring — The decision stays with the authorised person.
