<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-vulnerability-exception-management
description: >-
  Manage vulnerability exceptions including risk acceptance workflows, compensating
  controls documentation, exception expiration tracking, and audit trail generation
  for findings that cannot be remediated within standard SLA timelines.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - exception-management
  - risk-acceptance
  - compensating-controls
  - governance
  - audit-trail
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Vulnerability Exception Management

## Overview

Not every vulnerability can be patched within SLA — legacy systems, vendor
dependencies, and business constraints create exceptions. A formal exception
management process documents risk acceptance decisions, requires compensating
controls, sets expiration dates, and maintains audit trails for governance.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling |
| jq | `apt install jq` or `brew install jq` |
| Nessus Professional | Scan data source |
| Ticketing system | Jira/ServiceNow for tracking |

## Key Concepts

### Exception Types

| Type | Description | Max Duration |
|---|---|---|
| Risk Acceptance | Business accepts the risk with documented justification | 90 days |
| Compensating Control | Alternative mitigation reduces effective risk | 180 days |
| False Positive | Finding is incorrect — scanner misidentified | Permanent |
| Operational Constraint | Patch breaks functionality — vendor fix pending | Until vendor patch |

### Exception Request Template

```json
{
  "exception_id": "EXC-2024-0042",
  "cve_ids": ["CVE-2024-3400"],
  "affected_assets": ["fw-prod-01.example.com"],
  "severity": "critical",
  "exception_type": "compensating_control",
  "justification": "Vendor patch breaks VPN functionality. WAF rule deployed as compensating control.",
  "compensating_controls": [
    "WAF rule blocking exploitation pattern deployed",
    "Enhanced monitoring via Suricata IDS rule",
    "Network segmentation limits blast radius"
  ],
  "requested_by": "john.doe@example.com",
  "approved_by": null,
  "approval_level": "ciso",
  "requested_date": "2024-04-15",
  "expiration_date": "2024-07-15",
  "review_date": "2024-06-01",
  "status": "pending_approval"
}
```

### Approval Matrix

| Severity | Approver | Documentation Required |
|---|---|---|
| Critical | CISO | Full risk assessment + compensating controls |
| High | Director of Security | Risk justification + compensating controls |
| Medium | Security Manager | Brief justification |
| Low | Team Lead | Acknowledgment |

### Nessus Exception Integration

```bash
# Mark finding as accepted risk in Nessus
curl -sk -X PUT \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS;secretKey=$NESSUS_SECRET" \
  "https://localhost:8834/scans/$SCAN_ID/hosts/$HOST_ID/plugins/$PLUGIN_ID" \
  -d '{"status": "accepted"}'

# Export exceptions report
curl -sk -H "X-ApiKeys: accessKey=$NESSUS_ACCESS;secretKey=$NESSUS_SECRET" \
  "https://localhost:8834/scans/$SCAN_ID/export" \
  -d 'format=csv&chapters=vuln_by_host' | \
  grep "accepted" > accepted_risks.csv
```

### Compensating Control Verification

```bash
# Verify WAF rule is active (ModSecurity example)
curl -sk "https://target.example.com/" \
  -H "User-Agent: () { :; }; /bin/bash -c 'cat /etc/passwd'" \
  -o /dev/null -w "%{http_code}"
# Expected: 403 (blocked by WAF)

# Verify network segmentation
nmap -Pn -p 443,8834 $VULNERABLE_HOST --source-ip $UNTRUSTED_NETWORK
# Expected: filtered/closed from untrusted network

# Verify IDS rule active
grep "sid:9000001" /var/log/suricata/fast.log | tail -5
```

## Workflow

1. **Request** — Submitter documents exception with justification and compensating controls
2. **Review** — Security team validates compensating controls reduce effective risk
3. **Approve** — Appropriate authority approves based on severity matrix
4. **Implement** — Deploy and verify compensating controls
5. **Track** — Monitor expiration dates and schedule reviews
6. **Renew/Close** — Reassess at expiration: renew with updated justification or close

## Verification

| Check | Method |
|---|---|
| Exception documented | JSON record includes all required fields |
| Controls verified | Compensating control tests pass |
| Approval recorded | Approver signature/timestamp present |
| Expiration set | Date is within maximum allowed duration |
| Audit trail complete | All state transitions logged with timestamps |

## References

- [NIST SP 800-53 CA-7 — Continuous Monitoring](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [PCI DSS Compensating Controls](https://www.pcisecuritystandards.org/)
- [CIS Control 7.7 — Remediate Vulnerabilities](https://www.cisecurity.org/controls/continuous-vulnerability-management)
