Set an expiry on every accepted risk. A common pattern is 30 to 90 days for high severity items and up to 180 days for low severity ones, with early review if exploitation news, exposure or a fix changes. These periods are a policy choice, not a standard, so write yours down.
Why expiry beats open-ended acceptance
An acceptance reflects what you knew on the day you decided. Exploit code appears, a fix lands, a service becomes internet facing, and the old reasoning stops holding. The NIST Risk Management Framework includes a Monitor step that asks for continuous tracking of risks to the system, which is the same idea: a decision is not final, it is current.
Open-ended acceptances turn into a graveyard. After two years nobody remembers who approved what, and the dashboard shows a small, comforting number that hides old exposure.
A starting schedule
| Severity and context | Suggested maximum period | Renewal needs |
|---|---|---|
| Critical or known exploited | 30 days | Senior approver, active plan to fix |
| High, internet facing | 60 to 90 days | Approver plus written reason |
| Medium | 90 to 120 days | Owner sign off |
| Low, internal | 180 days | Owner sign off |
Treat the table as a starting point. If your remediation SLA for high findings is 30 days, an acceptance longer than that should feel uncomfortable, because it is a deliberate exception to your own rule.
Triggers for early review
- The vulnerability appears in the CISA Known Exploited Vulnerabilities catalog.
- The exploit probability estimate rises sharply.
- A fixed version is released.
- The asset moves to a more exposed network position.
- The compensating control fails or is removed.
Wire at least the first, third and fourth into automation, so the record reopens itself.
Renewal is a new decision
Do not renew by changing a date. Require the approver to re-read the current facts, confirm the compensating controls still run, and either extend with a reason or assign the fix. Keep each renewal as a new dated entry so the history shows the trail.
Report it
Show three numbers to leadership: accepted risks currently open, accepted risks expiring in the next 30 days, and accepted risks past expiry. The last one should always be zero.
Quick check
Is there an official maximum duration for risk acceptance?
No universal one. Frameworks ask for monitoring and review, but the period is set by your own policy.
What if the fix is blocked for a year?
Renew in short cycles with fresh evidence and stronger compensating controls, rather than one long acceptance.
Safeguard tracks findings with policies and gates, and you can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
