Tell leadership before the deadline, not after. Say which items will miss, why, what the exposure is in the meantime, the new date with a confidence level, and the one decision you need from them. Early, specific news is received far better than a surprise on the due date.
Why early matters
A missed service level is a data point. A hidden missed service level is a trust problem. Leaders can reallocate people, accept risk formally or call a vendor only if they know in time. Once the date passes, their options shrink and their question becomes "why were we not told?"
Pick a trigger for escalation, such as "when forecast completion is later than the due date by more than a few days." Writing the rule down removes the temptation to wait one more day.
The five parts of the message
- What will miss. The count and the names of the items, not "some findings."
- Why. One cause per item: capacity, a blocking dependency, a vendor without a fix, or an unclear owner.
- The exposure meanwhile. Is the asset internet facing? Is the vulnerability known to be exploited? Is the vulnerable code reachable?
- The new date. A date with a range, from a method like three-point estimates.
- The ask. A decision, with a deadline.
A table to bring
| Item | Cause | Exposure now | Interim control | New date | Ask |
|---|---|---|---|---|---|
| Library X in public API | Needs breaking upgrade | Reachable, internet facing | WAF rule in place | Two weeks, wide range | Approve borrowing one engineer |
| Base image Y | Waiting on platform team | Internal only | Network isolation | Four weeks | Escalate to platform lead |
| Package Z | No upstream fix | Not reachable per analysis | Monitor advisory | Review in 30 days | Approve a time-limited exception |
Keep the interim control column honest. A control that is promised but not live is not a control.
Separate the causes
Different causes need different asks.
- Capacity. Ask for people or for a feature trade, using the options format from the decision memo template.
- Blocked by another team. Ask for an escalation, with the other team's lead named.
- No fix exists. Ask for a formal exception with an expiry. See how long should a vulnerability exception last.
- Unclear ownership. Ask for an owner to be named today.
Avoid these mistakes
- Burying the miss in a dashboard average. A high overall compliance rate can hide the overdue tail, as SLA compliance rate hides the overdue tail explains.
- Giving a single date with false certainty.
- Asking for sympathy instead of a decision.
- Moving the clock. If the policy says the clock starts at discovery, do not restart it at triage without saying so. See when does the vulnerability SLA clock start.
After the miss
Record the miss, the cause and the decision. Review causes quarterly: if capacity keeps showing up, the service level is set too tight for current staffing, or the capacity is too small. Either way, the data supports the conversation about how much sprint capacity to reserve.
Safeguard's compliance and evidence automation can keep a dated record of findings, owners and exceptions, so the explanation to leadership and later to an auditor starts from facts. Its reachability analysis can also show which overdue items sit in code that runs.
Quick check
When should I escalate a likely miss?
As soon as the forecast shows the due date will be missed, not when it is missed. Set a written trigger so it does not depend on judgment each time.
Is it ever fine to quietly extend the deadline?
No. Extend through a recorded exception with an owner and an expiry, so the change is visible and reviewable.
Last reviewed: 19 October 2026.
