--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Exception rules overview # Exception rules overview {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exception rules overview Exception rules in Vulnerability Response enable ServiceNow customers to automate the deferral process for Vulnerable Items (VIs) that cannot be remediated or deferred immediately. By defining conditions based on impacted vulnerabilities, configuration items (CIs), or VIs, customers can automatically defer matching VIs for a specified period, reducing manual effort and minimizing the risk of missing service level agreements (SLAs). Show full answer Show less ## Key Features * **Automated Deferral:** Exception rules automatically defer new and existing VIs matching approved conditions, streamlining vulnerability management. * **Rule Ordering and Priority:** Exception rules are executed by priority, with the highest-priority rule applied first. Once a VI is deferred by a high-priority rule, no subsequent rules are applied. * **Integration with Exception Management:** Rules can only be created when Vulnerability Response is selected in Exception Management configuration. * **Lifecycle Management:** Supports full lifecycle of exception rules including creation, approval, activation, deferral, and expiry. * **Approval Workflow:** Two-level approval process for exception rule requests ensures governance. Approvals can be managed via Flow Designer from VR version 15.0 onward. * **Deferred Remediation Tasks:** When a VI is deferred, it is copied to a remediation task (RT) in the Deferred state, while still remaining part of existing RTs. * **Execution on Existing Data:** Optionally, rules can run on existing VIs as of the "Valid from" date through a scheduled job. ## Key Outcomes * Customers can request and approve exceptions to defer remediation of complex or unremediable VIs automatically and securely. * Deferral periods are clearly defined, after which deferred VIs return to Open status and are re-evaluated for remediation task allocation. * Exception rules help maintain compliance and SLA adherence by reducing manual intervention and automating exception handling within Vulnerability Response. * Expired rules stop applying to new or reopened VIs, ensuring clear governance and lifecycle control over exception deferrals. Exception rules for Vulnerability Response enable you to automate the deferral process for vulnerable items (VIs). Request an exception for the vulnerable items (VIs) that can't be remediated or deferred immediately, by identifying the impacted vulnerabilities, configuration items (CIs), or VIs. Defer the matching VIs based on the rule when the system identifies them by automating the VI deferral process. Using exception rules in your organization Use exception rules to automatically defer new and existing VIs for a specific period if they match the approved rule condition. Automation minimizes the risk of missing service level agreements and makes it easier to manage multiple items, because you are eliminating manual intervention. Deferral rules support ordering, that is, the rule with the highest priority is run first. When a high-priority rule is applied on a VI, no subsequent rules are applied on it again even if the condition matches the VI. Note: * You can only create rules if you select Vulnerability Response in the Exception Management configuration. For details, see [Configure Exception Management for Vulnerability Response](https://www.servicenow.com/docs/rO4q5vOFpibwmZKMKTwDHA "When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a vulnerable item (VI) or remediation task (RT) that cannot be remediated according to the policy."). * When VIs are deferred by an exception rule, they are copied to the deferral remediation task (RT) that is created. The VIs continue to be part of the RTs they were part of earlier. {#vi-classification-rule-based__ul_ofx_r3h_kyb} The life cycle of an exception rule is as follows: * Creating an exception rule * Approving an exception rule request * Activating an exception rule * Deferring an exception rule * Expiry of an exception rule {#vi-classification-rule-based__ul_mhc_1nn_2nb} Creating an exception rule You can create an exception rule to automatically defer the VIs that match the defined conditions for the specified period. After you create an exception rule, submit it for approval. Approving an exception rule request Approving an exception rule request is a two-level process. If only the first-level approver is present, the exception rule can be assessed and approved by a single approval. However, if there's no first-level approver, an exception rule approval can't be approved. After the rule is approved, a remediation task (RT) is created. See [Approve an exception rule request](https://www.servicenow.com/docs/gpkkZ5mrTNOMFpZOGZLS4A "Assess exception rule requests from users so that you can approve or reject these requests.") for more information. Note: Starting from Vulnerability Response v15.0, if you are deploying the VR application for the first time, the flow designer for exception management is enabled by default. If you are already using the workflow, you can update to the flow designer. In both cases, you cannot change it back to workflow. To configure approval rules for exception management and false positive, see [Configure approval rules for Exception Management](https://www.servicenow.com/docs/lPUbRlA26EY7wyFxQubSJg "Starting with Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Vulnerability Response (VR) for the first time, the flow designer is enabled by default."). After an exception rule request is approved, you can perform the following actions: * Cancel * Delete {#vi-classification-rule-based__ul_h32_y22_4lb} Activating an exception rule After an exception rule is approved, a remediation task is created in a Deferred state by default. Starting from the "Valid from" date, the exception rule runs on all the VIs that are created and also on the ones that are moved from the Closed to the Open state. Note: If you enable the Execute on existing data option, a scheduled job runs once on the existing data on the "Valid from" date. Deferring an exception rule You can defer VIs that match the conditions defined in this exception rule, up to the "Deferred until" date that is defined for the rule. On this date, the remediation task that you created for the exception rule is closed and all the VIs in this group move back to the Open state. Group rules are applied on them again to allocate them to the required RTs. Expiry of an exception rule After the exception rule expires, it no longer runs on new or reopened VIs. The associated RT remains in the Deferred state until the "Deferred until" date. Figure 1. Exception rules work flow prior to v15.0