Risk acceptance
A documented decision by an accountable owner to tolerate a known risk without further treatment, for a stated period and with conditions that trigger review. When it waives a policy requirement it is often called a risk exception; it records a choice and does not reduce the risk.
- Also called
- risk exception · accepted risk
Covered in
Approve, expire and measure security exceptions without hiding risk
Keep temporary acceptance separate from remediation and measure outcomes using definitions that survive changing visibility.
Case study: First American's EaglePro document exposure (2019)
How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.
Harden the images you ship against CIS, STIG and SCAP benchmarks
Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.
Practice: Local project: Gate an image build on a CIS scan and a deviation register