Skip to content
VOC.

06 · VOC area

Exceptions & Risk Acceptance

Not every vulnerability can be fixed on time, and pretending otherwise produces silent risk. This area covers exception types, approval authority by risk level, compensating controls, expiry and re-review, and keeping an exception register leadership can trust.

Guides in this area

  1. Vulnerability exceptions and risk acceptance

    Run a vulnerability exception process that stays honest: exception types, approval by risk level, compensating controls, expiry and an auditable register.