--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Exception Management overview # Exception Management overview {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exception Management overview Exception Management in ServiceNow Vulnerability Response allows organizations to handle situations where they cannot comply with published vulnerability management or security policies. It provides a formal process to request, review, approve, or reject exceptions for vulnerable items (VIs) or remediation tasks (RTs) that cannot be remediated immediately due to lack of patches, fixes, or other constraints. Approving an exception means accepting the associated risk and consequences of deferring remediation. Show full answer Show less ## Key Features * **Exception Request:** Remediation owners can request exceptions for VIs or RTs to defer remediation for a specified period, such as when patches are unavailable. * **Approval Workflow:** Exception requests undergo review and risk assessment by vulnerability analysts. Approval can involve one or two levels of approvers, depending on configuration. Without a first-level approver, exceptions cannot be requested. * **Flow Designer Integration:** Starting with Vulnerability Response v15.0, exception management uses flow designer by default, replacing the earlier workflow system. This enhances configurability of approval rules. * **Exception Actions Post-Approval:** Once approved, exceptions can be reopened, deleted, or updated (including assignment changes). * **Status Tracking:** Exception statuses can be tracked via the State Change Approvals tab on the VI or RT. Note that actions on RTs do not track individual VIs within that task. * **Expiry Handling:** Upon expiry of an exception, the VI or RT reverts to the Open state, prompting remediation. * **Multiple Deferrals Tracking:** The system tracks how many times a VI or RT has been deferred, helping identify repeatedly deferred vulnerabilities for better management. ## Practical Benefits for ServiceNow Customers By using Exception Management, ServiceNow customers can formally document and control risk acceptance when vulnerabilities cannot be immediately remediated. It ensures compliance processes remain transparent and auditable, while providing flexibility to handle real-world constraints like unavailable patches. The integrated approval workflows and tracking capabilities enable organizations to maintain oversight and accountability for deferred remediation, reducing security risk exposure and improving governance. Additionally, customers leveraging the Vulnerability Manager Workspace or IT Remediation Workspace can seamlessly request exceptions within their existing workflows, enhancing efficiency and consistency across vulnerability and remediation management. When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a vulnerable item (VI) or remediation task (RT) that cannot be remediated according to the policy. Some vulnerabilities might not have an existing patch, fix, or solution. When an exception is approved, it also means that you're accepting a risk because you're acknowledging and agreeing to the consequences of not remediating the vulnerability. ## Life cycle of an exception {#vr-exception-management__section_ems_dy3_flb} Definition of an exception : An exception is a request to defer the remediation of a VI or RT for a specified period. For example, as a remediation owner, you can request an exception if a patch is not available for a machine. Requesting an exception : As the remediation owner, you can ask for an exemption for a VI or RT using the exception management process. After the exception approver approves this request, the VI or RT moves to a Deferred state. Approving an exception request : VIs or RTs that can't be remediated immediately are reviewed by vulnerability analysts, assessed for risk, and approved for deferral until they can be remediated. Approving an exception request can be a two-level workflow. If only the first-level approver is present, the exception can be requested and approved. However, if there's no first-level approver, an exception can't be requested. See [Add an exception approver](https://www.servicenow.com/docs/RgJlUGetLJfzL_xX_MGbHw "Add users to the approver groups so that you can request an exception.") for more information. Note: * Starting from Vulnerability Response v15.0, if you are deploying the VR application for the first time, the flow designer for exception management is enabled by default. If you are already using the workflow, you can update to the flow designer. In both cases, you cannot change it back to workflow. To configure approval rules for exception management and false positive, see [Configure approval rules for Exception Management](https://www.servicenow.com/docs/lPUbRlA26EY7wyFxQubSJg "Starting with Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Vulnerability Response (VR) for the first time, the flow designer is enabled by default."). Once an exception request for a VI or RT is approved, you can perform the following actions: * Reopen * Delete * Update the Assignment to or Assignment groups fields {#vr-exception-management__ul_h32_y22_4lb} * Starting with v23.0 of Vulnerability Response, the Exception Rule State Approval workflow is deprecated and replaced by the flow Exception Rule Approval in the flow designer. {#vr-exception-management__ul_sff_qhl_dcc} Tracking an exception request : After raising the exception, you can track its status by using the State Change Approvals tab of the VI or RT. If an action is taken on an RT, you can't track the status of the individual VIs in that RT. Expiry of an exception request : When an exception request for a particular VI or RT expires, the impacted VI or RT reverts to its Open state. Figure 1. Exception management approval process prior to VR v15.0 If a single VI or all the VIs in a RT pass in the next scan, then the VIs and, where applicable, the RT State field changes to Closed with the substate Fixed. ## Multiple deferrals {#vr-exception-management__section_kgk_vkw_h5b} Track the number of times a record or a remediation task is deferred. A scheduled job, set deferral counts, runs daily to post counts for the records that are deferred more than once in the Deferral count column in the Multiple deferrals module for VR. All counts for records associated with a remediation task are collected and posted if a remediation task is deferred more than one time. **Related concepts** * [Request exceptions for remediation tasks and records in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/P1ROWqXCO8TTltCkL~wLXw "From the Vulnerability Manager Workspace, vulnerability managers and analysts can request exceptions and false positives for a remediation task (VUL, AVUL, CVUL or CRG) and record (VIT, CVIT, AVIT or CTR). You can also split a remediation task and create change requests.") **Related tasks** * [Request an exception in the IT Remediation Workspace](https://www.servicenow.com/docs/goMMyVBzgcWpDLWpiXhL4w "Request an exception for the host vulnerable item (VIT), application vulnerable item (AVIT), container vulnerable item (CVIT) and remediation task (VUL, AVUL, CVUL, or CRG) from the IT Remediation Workspace.") * [Request an exception using GRC: Policy and Compliance Management in the IT Remediation Workspace](https://www.servicenow.com/docs/03YHRoJKGowDgrcEeboBbg "Request a policy exception for the host vulnerable item (VIT), application vulnerable item (AVIT), container vulnerable item (CVIT) or remediation task (VUL, AVUL, CVUL, or CRG) from the IT Remediation Workspace.")