For any exception that lasts longer than a quarter, or that covers a high-impact system, a quarterly owner re-attestation is worth the few minutes it takes. The owner confirms in writing that the scope, the reason, and the other controls are still true. Short exceptions rarely need it, because the expiry does the same job.
Conditions drift. A service that was internal becomes internet-facing. A network control gets removed in a migration. An exception that was reasonable in June can be wrong in October without anyone deciding to change it.
What the owner confirms
Keep the attestation to four yes or no questions plus a comment box.
- Is the component and version still the one described?
- Is the asset still exposed the way the record says?
- Are the other controls listed still in place?
- Has anything changed that the approver should know?
Any "no" triggers a re-review by the approver, not an automatic renewal.
Who sends it and how
Generate the list from the register: every active exception older than 90 days, grouped by owner. Send one message per owner with links to their records, not one per exception. Give a week to respond. Track replies in the same system so the evidence lives with the record.
| Result | Action |
|---|---|
| All yes | Log the date, continue |
| Any no | Re-review, shorten or revoke |
| No response | Escalate to the owner's manager, then revoke if still silent |
The last row matters. An exception whose owner has stopped answering is a candidate for revocation, since nobody is vouching for it.
Keep it proportional
Do not attest every exception every quarter if you have hundreds. Tier them. High-impact or externally exposed systems get quarterly checks. Lower tiers get an annual one, or rely on the expiry. The cost of the process should be smaller than the cost of the risks it watches.
What auditors see
A dated attestation per exception per quarter reads as ongoing monitoring of the control, which many auditors look for beyond approval. It also helps when someone leaves, because a missing reply surfaces the orphaned record quickly. NIST SP 800-40 Rev. 4 treats patch management as a recurring maintenance activity, and a recurring owner check fits the same rhythm.
Where Safeguard fits
Safeguard's continuous monitoring watches findings and assets on an ongoing basis, which gives owners fresh data to answer the attestation questions against.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how status changes over time and ask which change would make you answer "no" to one of the four questions.
Quick check
Does re-attestation replace the expiry date?
No. The expiry is the hard stop. Re-attestation is a mid-term check that catches drift sooner.
What if the owner left the company?
Reassign it to a named person or revoke it. An exception with no owner has no one accountable for it.
Sources
Last reviewed: 19 October 2026.
