Agree an escalation path in advance: the review group hears the case within a set number of days, a named executive breaks ties, the decision and reasons are recorded, and it is revisited on a date with fresh data. Disputes are normal. Unresolved disputes are the real risk.
Why disputes happen
A blocked dependency stops a release. Engineering sees delay, security sees exposure, and both are right about their part. NIST SP 800-161 Rev. 1 says processes should address when and how the escalation of risk decisions needs to occur, informed by risk profile, appetite and tolerance. That sentence is the whole job of an escalation path.
A four rung ladder
| Rung | Who | Time limit | Typical outcome |
|---|---|---|---|
| 1 | Developer and security contact talk it through | 1 working day | Fix, replace, or agree a short exception |
| 2 | Team lead and security lead | 2 working days | Compensating controls or a plan |
| 3 | Review group | Next meeting, or emergency session | Approve with expiry, deny, or defer |
| 4 | Accountable executive | 3 working days | Final decision, recorded |
The time limits are examples. What matters is that each rung has one.
What to bring to each rung
- The component, version and what it does in the product.
- The issue: severity, whether the affected code path is reachable, whether it is exploited in the wild.
- The cost of delay: which release, which customer commitment.
- Options: upgrade, replace, mitigate, accept for a limited time.
- A recommendation from each side, in one sentence.
Evidence narrows disagreements. If a vulnerable function is never called in your build, the argument changes. See how to scope a vulnerability exception to one asset.
Rules for fair decisions
- The person who benefits from the outcome does not decide alone.
- Reasons are written down, including the losing side's concerns.
- Every acceptance has an expiry and an owner.
- A decision can be reopened if facts change, such as exploitation starting.
- Track disputes by theme. Repeated disputes about the same library mean the standard is unclear or the library should go.
Culture matters as much as process
Teams accept losing when they see the reasoning and know the topic will be revisited. Publish anonymized decision summaries monthly so people learn what is likely to pass. Praise teams that raise problems early.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what evidence it surfaces about whether an issue can actually be exploited in your context.
Safeguard's reachability analysis and policy gates give both sides shared facts, and its records show what was decided and when.
Quick check
Who has the final say?
A named executive, agreed in the charter. NIST says risk decisions should escalate through defined processes.
Can a decision be reopened?
Yes, when facts change, and always at its expiry.
Sources
Last reviewed: 19 October 2026.
