Risk exception: [short title]¶
An exception records accepted residual risk. It does not convert a failed control into a pass.
| Field | Value |
|---|---|
| Exception ID | |
| Affected release/environment | |
| Affected control IDs | |
| Requested by | |
| Accountable risk owner | |
| Security/privacy/legal reviewers | |
| Created at | |
| Automatic expiry | |
| Remediation owner and due date |
Failed or blocked requirement¶
Describe the requirement, current condition, affected users/data/systems, and why it cannot be resolved before the release decision.
Risk analysis¶
- Threat or failure scenario:
- Likelihood and basis:
- Impact and blast radius:
- User, security, privacy, integrity, financial, legal, safety, and operational effects:
- Detection limitations:
- Worst credible outcome:
Compensating controls¶
Describe controls already implemented and attach evidence that they work. Planned controls are remediation, not compensation.
Monitoring and response¶
- Detection signal and threshold:
- Dashboard/alert owner:
- Immediate containment:
- Feature disablement or rollback path:
- Incident declaration criteria:
Scope reduction¶
Record any cohort, region, feature, traffic, data, or permission reduction used to bound the risk.
Decision¶
- Decision: Approve / Reject
- Risk owner:
- Decision date:
- Rationale:
- Required conditions:
Closure¶
- Remediation evidence:
- Closed by:
- Closed at:
- Review of any incidents or near misses: