Approve, expire and measure security exceptions without hiding risk

A security exception is a temporary decision to operate with a known unmet requirement. It should describe the scenario, affected assets and versions, credible consequence, exposure, interim controls, expiry and authorized risk owner. A severity label or a statement that the business accepts risk is too vague to support a later review. The owner must understand what remains possible and have authority over the relevant business consequence.

Use risk calculations only when their assumptions are explicit. The exercise supplies illustrative annualized incident probabilities and loss estimates to compare two options. Expected loss is probability multiplied by consequence; it is not a prediction of the exact future and cannot capture every tail outcome or legal duty. An uncertain estimate should be presented as a range. A local acceptance threshold helps structure discussion, but no arithmetic can authorize a decision reserved to another role or waive an applicable legal requirement.

Encode the record so tools can enforce it. The JSON Schema below rejects a missing expiry, an approval without a date and an approved record whose interim controls have not all passed. JSON Schema cannot compare two fields, so check separately that riskOwner differs from requestedBy and holds authority for the scenario. NIST IR 8286 Rev. 1 (December 2025) describes how such records feed an enterprise risk register, and CSF 2.0 outcome GV.RM-02 asks for the risk appetite and tolerance statements that bound who may accept what.

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Security exception record",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "id",
    "findingId",
    "release",
    "scenario",
    "requestedBy",
    "riskOwner",
    "status",
    "firstOpened",
    "expires",
    "interimControls",
    "reopenTriggers"
  ],
  "properties": {
    "id": { "type": "string", "pattern": "^EX[0-9]+$" },
    "renews": {
      "type": "string",
      "pattern": "^EX[0-9]+$",
      "description": "Earlier record; keep its firstOpened date"
    },
    "findingId": { "type": "string", "minLength": 1 },
    "release": { "type": "string", "minLength": 1 },
    "scenario": { "type": "string", "minLength": 20 },
    "requestedBy": { "type": "string", "minLength": 1 },
    "riskOwner": {
      "type": "string",
      "minLength": 1,
      "description": "The role authorized to accept this risk"
    },
    "status": { "enum": ["requested", "approved", "rejected", "expired", "closed"] },
    "firstOpened": { "type": "string", "format": "date" },
    "approvedAt": { "type": "string", "format": "date" },
    "expires": { "type": "string", "format": "date" },
    "interimControls": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["control", "evidence", "result"],
        "properties": {
          "control": { "type": "string" },
          "evidence": { "type": "string" },
          "result": { "enum": ["pass", "fail", "not tested"] }
        }
      }
    },
    "reopenTriggers": { "type": "array", "minItems": 1, "items": { "type": "string" } }
  },
  "if": { "required": ["status"], "properties": { "status": { "const": "approved" } } },
  "then": {
    "required": ["approvedAt"],
    "properties": {
      "interimControls": {
        "items": { "properties": { "result": { "const": "pass" } } }
      }
    }
  }
}

A compensating measure should break a step in the described attack path. For an exposed administrative export endpoint, requiring a constrained access gateway can reduce who reaches it; adding an alert only improves detection and response after access. Logging does not prevent data disclosure. Test the actual deployed route, including alternate hostnames and direct backend access, before assigning preventive credit.

In the fixture, a gateway reduces the assessed annual incident probability from 0.20 to 0.05 only if direct access is denied. Test E2 shows the direct backend remains reachable. Therefore the lower estimate is unsupported and must not be used in the approval request. The engineering team can repair that route, retest it and update the evidence; /domains/runtime/api-security/api-gateway-inventory/ covers gateway bypass. The business tradeoff is restricted access and gateway availability dependency during the exception period. If the gateway fails, the exception conditions should fail closed or trigger an explicit escalation, not silently restore public access.

First American shows the failure these controls prevent: a penetration test finding was entered at a lower severity by a clerical error, missed its deadline and was never escalated for risk acceptance, until a journalist found the same flaw (/domains/appsec/authorization/case-study-first-american/).

Exception metrics should include active, expired, renewed and overdue-remediation populations. If twelve of twenty exceptions expire this month and nine are resolved before expiry, the on-time resolution rate is 9/12, not 9/20. The denominator is the cohort whose deadline occurred. Three unresolved expired exceptions remain visible even if a new exception ID is created. Renewal should retain the original age and reason so repeated deferral cannot reset performance history.

Risk-weighted dashboards can help prioritize but should not erase raw counts and age. Closing ten low-consequence findings may improve average closure time while one critical exposure remains unchanged. Define timestamps and status semantics before comparing teams, as /frameworks/appsec-metrics-and-slas/ does. NIST CSF, SSDF and SAMM provide risk and improvement context; the calculations and thresholds here are a local teaching policy. None of those sources prescribes this specific expected-loss threshold or grants a universal exception period.

At expiry, the accountable owner chooses between verified remediation, renewed acceptance with updated evidence, or suspension/restriction of the affected feature. A review should compare the original conditions with current deployed facts. Changes in exploit availability, data volume, access paths or ownership may invalidate the earlier decision before its calendar expiry. Record immediate reopening triggers as well as the planned review date.

The complete decision record links exception EX7 to release E5, finding F2, tests E1/E2, the estimate assumptions and the authorized owner. An engineer can draft this record without pretending approval has occurred. Keep requested and approved states distinct. The exercise asks you to deny the current proposal under its own assumptions, calculate what a repaired-control scenario would mean, and correct a misleading metric. That combination tests causal evidence, quantitative reasoning and accountability rather than form completion.

Run a daily report over the exception records. The script validates each record against the schema above (with format checking), rejects a requester accepting their own risk, flags approved exceptions that have expired or expire within 14 days, lists every requested or approved exception as open risk with its age, and catches renewals that move firstOpened forward, which would reset the age and hide repeated deferral.

On 10 October 2026, with four sample records, it lists EX7 as a nine-day-old open request, warns that EX3 expires on 20 October and needs a decision from Dana, and reports that EX9 renews EX4 but moved firstOpened from 1 April to 30 September. Keep the original date: the finding has been open since April. Tested with Python 3.14 and jsonschema 4.26.0.

"""Validate exception records and list the decisions due.

Usage: python exception_report.py exception.schema.json exceptions.json 2026-10-10
"""
import json
import sys
from datetime import date, timedelta

from jsonschema import Draft202012Validator, FormatChecker


def report(schema, records, today, soon=timedelta(days=14)):
    validator = Draft202012Validator(schema, format_checker=FormatChecker())
    by_id = {r["id"]: r for r in records}
    for r in records:
        for error in validator.iter_errors(r):
            print(f"INVALID {r['id']}: {error.message}")
        if r["riskOwner"] == r["requestedBy"]:
            print(f"INVALID {r['id']}: the requester cannot accept their own risk")
        earlier = by_id.get(r.get("renews"))
        if earlier and r["firstOpened"] != earlier["firstOpened"]:
            print(f"AGE RESET {r['id']}: renews {earlier['id']} but firstOpened moved from "
                  f"{earlier['firstOpened']} to {r['firstOpened']}")
        expires = date.fromisoformat(r["expires"])
        if r["status"] == "approved" and expires < today:
            print(f"EXPIRED {r['id']}: expired {expires}; remediate, renew on fresh evidence or restrict")
        elif r["status"] == "approved" and expires - today <= soon:
            print(f"DUE SOON {r['id']}: expires {expires}; schedule the decision with {r['riskOwner']}")
        age = (today - date.fromisoformat(r["firstOpened"])).days
        if r["status"] in ("requested", "approved"):
            print(f"OPEN RISK {r['id']}: finding {r['findingId']} open {age} days, status {r['status']}")


if __name__ == "__main__":
    schema = json.load(open(sys.argv[1], encoding="utf-8"))
    records = json.load(open(sys.argv[2], encoding="utf-8"))
    report(schema, records, date.fromisoformat(sys.argv[3]))

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. NIST IR 8286 Rev. 1: Integrating Cybersecurity and Enterprise Risk Management (December 2025)
2. NIST Cybersecurity Framework (CSF) 2.0. CSWP 29 (February 2024).
3. NIST SP 800-218: SSDF 1.1, final. Version 1.1 (February 2022).
4. OWASP SAMM version 2 model
5. JSON Schema: draft 2020-12 specification

Reference information

Tags

Vulnerability managementAppSec programs

SDLC phase

MaintenanceSecurity program

Role

Security leaders

Download this guide as Markdown

Continue exploring