Glossary
Risk acceptance
A documented, time-limited decision by an accountable owner to tolerate a known vulnerability instead of remediating it.
Risk acceptance is the formal decision to live with a vulnerability that cannot reasonably be fixed — for example on end-of-life systems, vendor-controlled appliances, or when the fix would cause more harm than the risk. It differs from a deferral, which postpones a fix to a planned date, and from a false positive, where the vulnerability is not actually present.
A sound risk acceptance names the accountable business owner, explains the rationale, lists compensating controls with evidence, and expires on a specific date. It should be re-reviewed early if the risk changes, above all when the vulnerability becomes known to be exploited.
For a VOC, visible risk acceptance is what keeps SLAs credible: overdue findings then mean something went wrong, not that everyone quietly gave up. See exceptions and risk acceptance.