Exceptions that expire, every time.
Govern temporary deviations from security requirements, from a USB port or EDR exclusion to a firewall rule or delayed patch, with intelligence-informed review, two-level approval, evidence gates and automatic expiry.
| ID | Exception | Severity | Status |
|---|---|---|---|
| SEX-0142 | Legacy TLS 1.1 on billing gateway | High | Approval |
| SEX-0139 | EDR agent not supported on OT host | Medium | Active |
| SEX-0131 | Shared admin for vendor appliance | High | Review |
| SEX-0127 | Unpatched DB pending vendor fix | Critical | Active |
Illustration with sample data
What Security Exception Management does
Security Exception Management is a governed register in its own right, separate from risks and control exceptions but linked to them. Each exception type asks for the fields it needs. Requests are reviewed, then routed by severity to Level 1 and Level 2 approvers, all or any, sequentially or in parallel. An exception becomes Active only when every approval, every blocking collaboration and every mandatory evidence item is complete.
Before routing and every hour while it is in force, RiskVantis gathers security intelligence about the affected assets and controls: criticality, open risks and findings, control status, vulnerabilities, non-human accounts and similar past exceptions. Rules turn these into warnings, and ignoring a warning needs a reason. Expiry reminders go out from 30 days before, and an exception expires automatically. People without a login can raise a request from the sign-in page using a verified work email.
Key capabilities
Typed requests
Endpoint, network, application, data, cloud and custom types, each with its own fields.
Flexible routing
Severity-based Level 1 and Level 2 approval, all or any, sequential or parallel.
Activation gates
Approvals, blocking collaborations and mandatory evidence must all be complete.
Security intelligence
Asset, risk, finding, control and vulnerability context turned into explainable warnings.
Automatic expiry
Reminders from 30 days out, stage SLAs in business days, extensions reviewed as a new cycle.
Requests without a login
A verified-work-email request page for people outside RiskVantis.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Security Exception Management changes for your programme.
Exceptions without an end date
Every exception expires automatically; nothing stays active silently.
Less exception admin
Typed intake, routing, reminders and gates replace email threads and spreadsheets.
Clean approvals
The requester and the routing reviewer never approve, and nobody approves at both levels.
Decisions with intelligence
Approvers see what the exception touches before they decide.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Request
Raised in-app, or through the no-login request page with a verified work email.
Review and route
The Risk Team reviews, sets severity and routes to approvers.
Pass the gates
Approvals, evidence and collaborations complete; then it becomes Active.
Expire or extend
Reminders, automatic expiry, or an extension through the same path.
Supports your obligations.
Security Exception Management contributes evidence and coverage to these frameworks and regulations.
Common questions.
How is this different from a risk exception?
A risk exception defers treatment of a recorded risk. A security exception authorises a temporary deviation from a security requirement, such as a firewall rule or an EDR exclusion. It links to risks, controls and assets but never changes them.
Can people without a RiskVantis account request one?
Yes. A link on the sign-in page lets anyone with a work email from your organisation's domains request one after verifying a one-time code. Free and personal email addresses are refused.
Do warnings block approval?
Warnings are recommendations, and ignoring one needs a reason. An administrator can make a rule blocking for routing.
Works better together.
Risk Exceptions
A structured exception process with justification, compensating controls, remediation plans, two-level approval and time-boxed expiry, so every accepted risk has an…
Learn more →Control Assurance & Security ReviewsAsset Inventory, Ownership & RACI
A single asset inventory shared by every module. It is fed by imports, cloud discovery and assessments, matched on reliable identifiers rather than names, and governed…
Learn more →Platform, Security & IntegrationsAction Center & Email Approvals
Focus brings every approval, plan, task, evidence request and due date from every module into one list, ordered by urgency. Act inline, or straight from an email after…
Learn more →See Security Exception Management in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.