Direct answer
A risk exception should identify the affected asset, condition, reason for deferral, decision owner, temporary controls and expiry. Schedule review before expiry and reopen the decision when exposure or the planned fix changes.
Describe the exact gap
An exception for a legacy billing service should name the device or application, affected version, expected control and reason the owner cannot yet apply it. Avoid a blanket exception for an entire environment when the dependency affects one component.
Reference: NIST SP 800-40 Rev. 4: Enterprise Patch Management Planning.
Record the decision
Have the authorized risk owner acknowledge the residual risk and the planned fix. Include the evidence used for the decision and the people responsible for the temporary mitigation. A ticket left open without a named approver is not a complete risk decision.
- Record the business reason and affected scope.
- Set a review or expiry date and a named owner.
- Document what changes trigger an earlier review.
Test the temporary control
If network restriction is used while a patch is delayed, verify both that an unapproved source is blocked and that required support access still works. Record when and from where the check was performed; do not assume a rule is effective solely because a change was requested.
Reference: NIST SP 800-115: Technical Security Testing and Assessment.
Close or renew explicitly
At expiry, verify whether the fix has been deployed and retested. If it has not, reassess the exposure and seek a new decision rather than silently extending the exception. Retain the history so later reviewers can understand the change in risk.
Assessment limits
A documented exception does not remove the vulnerability or guarantee the temporary control is effective. Authority, review intervals and risk acceptance follow the organization's policy.
Frequently asked questions
Can an exception remain open indefinitely?
Use an explicit expiry and review process. If the issue persists, the authorized owner should reassess the risk and next steps.
Does a compensating control equal a fix?
Not necessarily. It may reduce exposure while the underlying condition remains; verify and describe its limits.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.