When an exception expires, the finding should return to active status automatically, gates and SLAs should apply again, and the owner and approver should be notified. Renewal is possible, but it needs a new review, fresh evidence and an approver, not a silent extension.
Why automatic expiry matters
An exception without enforced expiry is a permanent suppression with better manners. If someone has to remember to revisit it, they usually will not. The system should do the remembering.
For how to choose the length, see how long a vulnerability exception should last. This post covers what happens on the day.
The expiry flow
- Warn early. Notify owner and approver ahead of the end date, for example 14 and 3 days before. Pick your own timings.
- Expire on time. On the date, status returns to open. No grace period unless the policy states one.
- Gates apply. A pull request or release that would have passed because of the exception now fails on that finding.
- Decide. The owner picks one: fix, mitigate, or request renewal.
- Record. The outcome, and who decided, goes on the record.
Fix, mitigate or renew
| Outcome | What it needs |
|---|---|
| Fix | A merged change, then verify with a new scan |
| Mitigate | A tested compensating control and a smaller risk rating |
| Renew | New request with updated facts, a different approval, and a shorter or equal term |
Renewal should not be easier than the first request. If anything, it should be harder, because the team has had time to fix it and did not.
Limit renewals
Set a maximum number of renewals, such as two, after which a decision moves up a level. A third renewal usually means the real problem is cost or ownership, and that needs a leadership conversation, not another form.
Common failure modes
- Calendar only, no enforcement. The date exists but nothing happens on it.
- Auto-renew defaults. A convenience feature that defeats the control.
- Expiry during a release freeze. Plan for it. Either allow a short, recorded extension or move the freeze.
- No owner. Notifications go nowhere. See orphaned exceptions.
Where Safeguard fits
Safeguard continuously monitors findings and applies policies and gates, so an expired waiver can put a finding back in scope for a gate without manual cleanup.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how status changes are tracked over time rather than checked once.
Quick check
Should there be a grace period after expiry?
Ideally not. If the business needs one, make it explicit, short and recorded as its own approved extension.
Who gets notified?
The requester, the approver and the owning team channel. A named person should be responsible for acting.
Last reviewed: 19 October 2026.
