building-vulnerability-exception-tracking-system

name	building-vulnerability-exception-tracking-system
description	Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.
domain	cybersecurity
subdomain	vulnerability-management
tags	["vulnerability-exception","risk-acceptance","compensating-controls","exception-tracking","vulnerability-management","governance"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]
mitre_attack	["T1190","T1068"]

Building Vulnerability Exception Tracking System

Overview

A vulnerability exception tracking system manages cases where vulnerabilities cannot be remediated within SLA timelines. It provides structured workflows for requesting exceptions, documenting compensating controls, obtaining risk acceptance approvals, and automatically expiring exceptions when their validity period ends. This ensures organizations maintain visibility into accepted risks while complying with frameworks like PCI DSS, SOC 2, and NIST CSF.

When to Use

• When deploying or configuring building vulnerability exception tracking system capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Python 3.9+ with flask, sqlalchemy, requests, jinja2
• PostgreSQL or SQLite database
• Email/Slack integration for approval notifications
• Vulnerability management platform API (DefectDojo, Qualys, Tenable)

Exception Request Workflow

Exception Categories

Category	Description	Max Duration	Approver Level
Remediation Delay	Patch available but deployment blocked	30 days	Team Lead + Security
No Fix Available	Vendor has not released a patch	90 days	Security Director
Business Critical	System cannot be patched without outage	60 days	VP Engineering + CISO
False Positive	Finding is not a real vulnerability	Permanent	Security Analyst
Compensating Control	Alternative mitigation in place	180 days	Security Architect

Required Fields for Exception Request

exception_schema = {
    "cve_id": "CVE-2024-XXXX",
    "finding_id": "unique-finding-reference",
    "asset_hostname": "prod-db-01.corp.local",
    : ,
    : ,
    : ,
    : ,
    : [
        ,
        ,
        
    ],
    : ,
    : ,
    : [, ],
    : ,
}