Configuration Compliance Exception Management overview

Release version: Australia

Updated March 12, 2026

2 minutes to read

Summarize

Summarized using AI

Summary of Configuration Compliance Exception Management overview

Configuration Compliance Exception Management enables your organization to request, review, approve, or reject exceptions when a remediation task cannot comply with a vulnerability management or security policy, standard, or guideline. This process acknowledges and accepts the risk of not remediating a configuration-related vulnerability due to the absence of a patch, fix, or solution. Exception management is supported in both the Vulnerability Manager Workspace and IT Remediation Workspace.

Show full answer Show less

Key Features

Exception Life Cycle: Includes requesting, approving, tracking, and handling the expiry of exception requests.
Requesting Exceptions: Remediation owners can request exceptions from the IT Remediation Workspace, keeping the remediation task in an "In review" state until approval.
Approving Exceptions: Exception requests undergo risk assessment and can follow a two-level approval workflow. Approval moves the remediation task to a "Deferred" state. Approval or rejection actions can be performed in the Vulnerability Manager Workspace.
Workflow Updates: Starting from Configuration Compliance v13.0, the flow designer is enabled by default for exception management, replacing the previous workflow system.
Post-Approval Actions: Once approved, exception requests can be reopened or deleted. Rejection causes the remediation task to revert to its prior state, with comments recorded in work notes.
Tracking Exceptions: Use the State Change Approvals tab in the remediation task to monitor exception status. Individual test results cannot be tracked once actions are taken on the remediation task.
Exception Expiry: When an exception expires, the remediation task returns to the "Open" state, requiring remediation action.

Key Outcomes

Allows controlled deferral of remediation tasks while managing associated risks.
Provides clear visibility into the status and history of exception requests.
Supports compliance with security policies by formally managing exceptions rather than ignoring non-compliance.
Enables streamlined exception management processes through integrated workspaces and updated flow designer workflows.

When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions for a remediation task that cannot be remediated according to the policy.

Important:

Exception management is supported in the Vulnerability Manager Workspace and IT Remediation Workspace.

Note:

Starting with v14.9 of Configuration Compliance, the following terms have been renamed:

Table 1. Changes in terminology
Terminology prior to v14.9	Terminology v14.9 onwards
Test Result Group	Remediation Task
Group Rules	Remediation Task Rules
Policy	Test group

Some vulnerabilities might not have an existing patch, fix, or solution. When an exception is approved, it also means that you're accepting a risk because you're acknowledging and agreeing to the consequences of not remediating the configuration-related vulnerability.

Life cycle of an exception

An exception is a request to defer the remediation of a remediation task for a specified period.

The life cycle of an exception is as follows:

Requesting an exception
Approving an exception request
Tracking an exception request
Expiry of an exception request

Requesting an exception

As the remediation owner, you can ask for an exemption for a remediation task using the exception management process. During the approval process, the remediation task remains in In review state. After the exception approver approves this request, the remediation task moves to a Deferred state.

Important:

You can request an exception from the IT Remediation Workspace. For more information, see Request an exception in the IT Remediation Workspace.

Approving an exception request

Remediation tasks that can't be remediated immediately are reviewed, assessed for risk, and approved for deferral until they can be remediated. Approving an exception request can be a two-level workflow. If only the first-level approver is present, the exception can be requested and approved. However, if there's no first-level approver, an exception can't be requested. See Add an exception approver for Configuration Compliance for more information.

Important:

You can approve or reject an exception request from the Vulnerability Manager Workspace. For more information, see Request exceptions for remediation tasks and records in the Vulnerability Manager Workspace.

Note:

Starting from Configuration Compliance v13.0, if you are deploying the CC application for the first time, the flow designer for exception management is enabled by default. If you are already using the workflow, you can update to the flow designer. In both cases, you cannot change it back to workflow.

Once an exception request for a remediation task is approved, you can perform the following actions:

Reopen
Delete

Note:

Rejection comments are shown in the Work notes for a remediation task. If an exception request is rejected, this remediation task reverts to its previous state.

Tracking an exception request

After raising the exception, you can track its status by using the State Change Approvals tab of the remediation task. If an action is taken on a remediation task, you can't track the status of the individual test results in that remediation task.

Expiry of an exception request

When an exception request for a remediation task expires, the remediation task reverts to its Open state.

Exception management life cycle for CC — Figure 1. Exception management approval process prior to CC v13.0