Glossary: Vulnerability, Asset and Change Management

Exception (risk)

Also written: formal exception, risk exception

A written, approved decision to live with a finding for a set time. It names the reason, compensating controls, a risk owner and an end date, like Alex's exception for KC-FS1 that ends 2027-03-31.