Governing vulnerability exceptions at Hallbridge Health Group: a funnel narrows 11,842 findings past their remediation deadline to 4,118 genuinely not remediable, 2,317 with an exception record, then by authority, evidence, a compensating control that holds and a dated expiry, down to 187 governed exceptions; below it, the four records that are not synonyms — deferral, exception, risk acceptance and false positive; exception EXC-2019-0412, renewed eleven times, turned into a funded replacement programme; and an authority matrix that reserves internet-facing criticals to the Chief Risk Officer for at most 90 days.

CY-EXPERT-068Expert Level · Vulnerability Management

Vulnerability Exception Scenarios

An expert-level course on the discipline of deciding, recording and governing the cases where a known vulnerability will not be remediated within the standard SLA. Work down the funnel - eight narrowing bands carrying 11,842 findings past their remediation deadline down to the 187 that genuinely warrant an exception: decomposing the population; separating deferral, exception, risk acceptance and false positive; setting who may accept what by exposure and duration; fixing the evidence a request must carry; testing compensating controls instead of accepting them; using threat context to compress rather than to excuse; enforcing expiry and making renewal cost something; and reporting the register so a committee governs the trend rather than reading out a count.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Decompose a past-SLA finding population into retirement, duplication, validation and genuine exception candidates, and publish a dated reproducible baseline with its defects named.
Distinguish deferral, exception, risk acceptance and false positive by the decision each records, give each its own owner, duration, evidence and closure condition, and reclassify an existing register against them.
Set approval authority on exposure class and requested duration, with segregation, capped delegation and bounded interim decisions, and migrate an existing population approved without authority in sequenced tranches.
Specify the evidence an exception request must carry, enforce it with a completeness gate that returns incomplete requests unread, and prove the specification by reconstruction with an uninvolved reader.

Price:৳12,000