Treat a renewal as a new decision, not a date change. Re-check that the finding still exists, whether a fix is now available, whether exploitation status changed, and whether the original evidence still holds. Then choose: fix, renew with a shorter term, narrow the scope, or let it lapse.
Why renewal is the risky moment
Most exceptions are renewed at least once. The first approval had a person's full attention. The second often gets a skim, and by the third it is automatic. That is how a temporary waiver becomes permanent.
The four-option decision
| Situation | Choose |
|---|---|
| A fix or fix PR now exists | Fix and close the exception |
| Evidence still holds, no fix | Renew with a shorter term |
| Only part of the scope still needs it | Narrow, then renew |
| Evidence gone or risk grown | Let it lapse and block |
Re-review checklist
- Is the finding still present? Re-scan. Many exceptions outlive their issue.
- Is there a fix? Look for a new release or an open fix PR.
- Has exploitation changed? Check whether the vulnerability has been added to a known exploited list, such as CISA's catalog. That should reopen the discussion.
- Does the evidence hold? If the reason was "not reachable", re-run the check against current code.
- Do the compensating controls still work? Test them again, do not assume.
- Has the exposure changed? New integrations or data can alter the risk.
- What progress was made? Compare against the plan in the original request.
Make renewals harder on purpose
Add friction in proportion to the number of renewals. First renewal: same approver, fresh evidence. Second: a more senior approver. Third: a written plan to end it, or a decision that this is a risk acceptance to be reviewed at the highest level. The post on how long should a vulnerability exception last pairs well with this.
Track the renewal count
Put the number of renewals in the record and in the dashboard. A high count is a signal about fix ownership, not about the individual finding. See vulnerability exception metrics: aging, renewals and coverage.
Do not renew on the last day
If the renewal request arrives on expiry day, the reviewer has no time to check anything. Require submissions well before expiry, and let the reminder schedule do the work. Lapsing is allowed to be inconvenient. That is the point of an expiry.
Document what changed
Even for a clean renewal, write one or two lines: what was re-checked, what stayed the same and why the term is what it is. That sentence is what an auditor will read.
Safeguard's reachability analysis can re-check whether vulnerable code is still reachable in your current code, and its continuous scanning flags when a new fix or new advisory changes the picture.
Try it yourself
Click through it at your own pace, or open it full screen.
See how reachability evidence is shown, since a renewal should re-check exactly that.
Quick check
How many times can an exception be renewed?
Set a policy limit. After the limit, require an escalated decision or a formal risk acceptance.
Can renewal be automatic?
No. Automatic renewal converts a time-boxed waiver into a permanent one.
Sources
Last reviewed: 19 October 2026.
