Exception Management in Application Vulnerability Response

  • Release version: Yokohama
  • Updated January 30, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Exception Management in Application Vulnerability Response

    Exception Management in Application Vulnerability Response (AVR) enables organizations to request, review, approve, or reject exceptions when vulnerabilities cannot be remediated according to policy. This process acknowledges and accepts the risk of deferring remediation for application vulnerable items (AVIs) or remediation tasks (RTs). It is especially useful when patches or fixes are unavailable or when compliance with vulnerability management policies cannot be met.

    Show full answer Show less

    Key Features

    • Exception Requests: Developers can request exceptions to defer remediation of AVIs for a specified period. Once approved by application security analysts, the AVI status changes to Deferred.
    • Exception Rules: Starting with version 20, you can automate deferral of AVIs based on defined conditions, reducing manual effort and minimizing SLA breaches.
    • Extension Requests: You can request extensions to the Deferred until date for exception rules, with up to one year extension, subject to two-level approval.
    • Approval Workflow: Exception requests undergo a risk assessment and approval process, which can include one or two approval levels. Requests can be managed directly within the Vulnerability Manager Workspace.
    • State Management: Exception requests change the AVI status to In-Review during approval and to Deferred upon approval. If approval times out, AVIs revert to Open status. Expired exceptions also revert to Open unless extended.
    • Configuration and Integration: You can configure approval time frames, email notifications, and add questionnaires to exception requests. Exception management integrates with ServiceNow’s GRC Policy and Compliance Management and uses Flow Designer for approval workflows.
    • Deferral State: From version 20, the Awaiting Implementation state allows manual deferral of remediation tasks and AVIs during their lifecycle.
    • Approver Management: Administrators can add users to approver groups to enable exception request approvals.

    What This Enables You to Do

    • Manage vulnerabilities that cannot be immediately remediated without violating compliance policies.
    • Automate exception handling to maintain SLA adherence and reduce manual processing.
    • Track exception request status and maintain audit trails through state changes and approvals.
    • Extend exception periods responsibly with documented justification and multi-level approvals.
    • Configure tailored workflows, notifications, and approval processes to fit organizational policies.

    Practical Outcomes

    • Improved risk management by formalizing acceptance of deferred remediation and associated risks.
    • Enhanced visibility and control over exceptions, ensuring accountability and compliance.
    • Streamlined vulnerability remediation workflows with integrated exception handling.
    • Reduced risk of missing critical deadlines by automating deferral through exception rules.
    • Greater flexibility in managing AVIs and remediation tasks aligned with business realities and resource constraints.

    When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to an application vulnerable item (AVIT) that cannot be remediated according to the policy.

    Some vulnerabilities might not have an existing patch, fix, or solution. When an exception is approved, it also means that you're accepting a risk because you're acknowledging and agreeing to the consequences of not remediating the vulnerability.
    Note:

    Starting from v21.0 of Application Vulnerability Response, you can configure the time frames for approving false positives and exceptions, along with email notifications for both the approver and requester after a set number of days. When a request is raised, the application vulnerable item changes to In-Review status and a state change record is created. If the approver doesn't respond within the configured time frame, the application vulnerable item or remediation task reverts to Open status. The previous state is stored in the backup_state field. For more information, see Configure approval rules for Exception Management.

    Life cycle of an exception

    Definition of an exception
    An exception is a request to defer the remediation of an AVI for a specified period. For example, as a developer, you can request an exception if a patch is not available for a machine.
    Requesting an exception
    As the developer, you can ask for an exemption for an AVI using the exception management process. After the application security analyst approves this request, the AVI moves to Deferred state.
    Important:
    You can request exceptions for AVTIs and RTs from the Vulnerability Manager Workspace and IT Remediation Workspace respectively. For more information, see Request exceptions for remediation tasks and records in the Vulnerability Manager Workspace and Request an exception in the IT Remediation Workspace.
    Exception rules
    Starting with v20, you can create exception rules to automatically defer existing and new application vulnerable items (AVI)s for a specific period if they match the conditions of the rule. Using exception rules to automatically defer AVIs minimizes the risk of missing service level agreements. The rules can help you manage multiple items, because you are eliminating manual intervention. See Create an Exception rule.
    Requesting an extension for an exception rule
    Starting with v20, you can submit a request for an extension to the Deferred until date of an exception rule. You might request an extension to a rule if you find that a large number of records created by the rule are not being resolved by its Deferred until date, the date when the remediation task stops accepting new AVIs. The extension updates the exception rule so it automatically extends the deferral date on your existing rule. You can enter dates up to one year from the current date, and you must include a reason for the extension. An extension request requires two-level approval from separate approval groups.
    Approving an exception request
    AVITs that can't be remediated immediately are reviewed by application security analysts, assessed for risk, and approved for deferral until they can be remediated. Approving an exception request can be a two-level flow. If only the first-level approver is present, the exception can be requested and approved. However, if there's no first-level approver, an exception can't be requested. See Add an exception approver for Application Vulnerability Response for more information.
    Important:
    You can approve or reject exception requests in the Vulnerability Manager Workspace. For more information, see Approve or reject requests in the Vulnerability Manager Workspace.
    Note:
    After an exception request for an AVIT is approved, you can perform the following actions:
    • Reopen
    • Get more details
    Tracking an exception request
    After raising the exception, you can track its status by using the State Change Approvals tab of the AVIT.
    Expiry of an exception request and requesting an extension to an exception rule
    When an exception request for a particular AVI expires, the impacted AVI reverts to its Open state.

    However, starting with v20, you can submit a request to extend the Deferred until date on the exception rule.