Exception Management overview
Summarize
Summary of Exception Management overview
Exception Management in Vulnerability Response allows your organization to formally request, review, approve, or reject exceptions when a vulnerability or remediation task cannot be remediated according to published security policies or standards. This process acknowledges and accepts the risk associated with deferring remediation due to unavailable patches or other constraints.
Show less
Key Features
- Exception Definition: A request to defer remediation of a Vulnerable Item (VI) or Remediation Task (RT) for a specified time.
- Requesting Exceptions: Remediation owners can submit exception requests for VIs or RTs that cannot be immediately fixed.
- Approval Workflow: Exception requests undergo review and risk assessment by vulnerability analysts. Approval can involve a single or two-level approval process; exceptions cannot be requested without a first-level approver.
- Flow Designer Integration: Starting with Vulnerability Response v15.0, exception management workflows are managed via the Flow Designer by default, replacing the previous workflow approach.
- Post-Approval Actions: Once approved, exception requests can be reopened, deleted, or have their assignments updated.
- Tracking and Expiry: Exception requests’ statuses are tracked in the State Change Approvals tab. Upon expiry, exceptions revert the VI or RT to an Open state, requiring remediation.
- Multiple Deferrals: The system tracks how many times a record or remediation task is deferred, with counts visible in the Multiple Deferrals module, helping to monitor repeated exceptions.
Practical Implications for ServiceNow Customers
ServiceNow customers using Vulnerability Response can leverage Exception Management to formally manage situations where vulnerabilities cannot be immediately remediated. This ensures compliance with organizational policies while transparently acknowledging risk. The integration with Flow Designer streamlines approval processes, and tracking features provide visibility into exception statuses and expiration, enabling proactive risk management. Understanding how to request, approve, and manage exceptions helps maintain security governance even when immediate remediation is not possible.
When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a vulnerable item (VI) or remediation task (RT) that cannot be remediated according to the policy.
Some vulnerabilities might not have an existing patch, fix, or solution. When an exception is approved, it also means that you're accepting a risk because you're acknowledging and agreeing to the consequences of not remediating the vulnerability.
Life cycle of an exception
- Definition of an exception
- An exception is a request to defer the remediation of a VI or RT for a specified period. For example, as a remediation owner, you can request an exception if a patch is not available for a machine.
- Requesting an exception
- As the remediation owner, you can ask for an exemption for a VI or RT using the exception management process. After the exception approver approves this request, the VI or RT moves to a Deferred state.
- Approving an exception request
- VIs or RTs that can't be remediated immediately are reviewed by vulnerability analysts, assessed for risk, and approved for deferral until they can be remediated. Approving an exception request can be a two-level workflow. If only the first-level approver is present, the exception can be requested and approved. However, if there's no first-level approver, an exception can't be requested. See Add an exception approver for more information.
-
Starting from Vulnerability Response v15.0, if you are deploying the VR application for the first time, the flow designer for exception management is enabled by default. If you are already using the workflow, you can update to the flow designer. In both cases, you cannot change it back to workflow. To configure approval rules for exception management and false positive, see Configure approval rules for Exception Management.
Once an exception request for a VI or RT is approved, you can perform the following actions:- Reopen
- Delete
- Update the Assignment to or Assignment groups fields
- Starting with v23.0 of Vulnerability Response, the Exception Rule State Approval workflow is deprecated and replaced by the flow Exception Rule Approval in the flow designer.
- Tracking an exception request
- After raising the exception, you can track its status by using the State Change Approvals tab of the VI or RT. If an action is taken on an RT, you can't track the status of the individual VIs in that RT.
- Expiry of an exception request
- When an exception request for a particular VI or RT expires, the impacted VI or RT reverts to its Open state.
If a single VI or all the VIs in a RT pass in the next scan, then the VIs and, where applicable, the RT State field changes to Closed with the substate Fixed.
Multiple deferrals
Track the number of times a record or a remediation task is deferred. A scheduled job, set deferral counts, runs daily to post counts for the records that are deferred more than once in the Deferral count column in the Multiple deferrals module for VR. All counts for records associated with a remediation task are collected and posted if a remediation task is deferred more than one time.