Every vulnerability programme has findings it will not fix this month. Some cannot be patched without breaking something. Some sit on systems due to be retired. Accepting them is legitimate. Accepting them badly is how an old finding becomes an incident.
A risk acceptance that holds up has six parts.
- The finding, by identifier, on the named system.
- Why it cannot be fixed now, in one sentence.
- What reduces the risk in the meantime. Isolated, filtered, monitored or disabled, and evidence that it was done.
- Who accepted it. A person who owns the business risk, not the engineer who raised it.
- When it expires. Pick a period you will actually review. Never open ended.
- What cancels it early. The obvious trigger is the finding being added to the KEV list.
The sixth part is the easiest to forget. An acceptance signed in March for a vulnerability nobody was exploiting does not hold once someone starts exploiting it. The register should show that the same day, not at the next quarterly review.
Def Stan 05-138 control 2402 asks for a Risk Treatment Plan. This is what the accept line of that plan should look like.
