Direct answer
An exception inventory connects each approved deviation to the policy, affected assets, reason, owner, mitigation and expiry. Review overdue or changed exceptions with the authorized risk owner and verify that temporary controls remain effective.
Capture the specific deviation
For a legacy endpoint that cannot yet receive a required update, identify the device, version, affected policy and business dependency. Do not use a broad permanent exception when the reason applies only to a small set of devices.
Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.
Record accountability
Include the approver, operating owner, evidence reference and review date. A service provider may operate a temporary control, but an internal owner should coordinate the customer-side decision and monitor the commitment.
- Record the reason and residual risk.
- Name the temporary control and its verifier.
- Set an expiry and earlier review triggers.
Review changes
A new exposure, vendor fix or change in asset role can invalidate the original decision before the scheduled expiry. Check that the compensating control still works and that the planned permanent fix remains viable.
Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.
Close or renew deliberately
After the fix, verify effective state and retain the evidence and closure date. If the issue remains, require an explicit new risk decision. Report overdue and unowned exceptions instead of hiding them in a summary count.
Assessment limits
An exception register documents decisions; it does not remove risks or prove compensating controls are effective. Follow the organization's approval and retention policies.
Frequently asked questions
Is an exception the same as a false positive?
No. An exception accepts or manages a real deviation temporarily; a false positive means evidence shows the reported condition does not apply.
Should exceptions renew automatically?
They should receive an explicit review and decision under the organization's policy, with an accountable owner.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.