Match the approver to the size of the risk. Low-risk, short exceptions can go to a team lead plus security. Serious ones on internet-facing systems should go to someone who owns the business risk, such as a director or the CISO. Never leave it to the person who wants the exception.
The principle: authority follows exposure
NIST SP 800-53 control RA-7 asks organizations to respond to findings from assessments, monitoring and audits "in accordance with organizational risk tolerance." Risk tolerance is a statement about who may accept how much. An approval ladder is how you write that down for vulnerabilities.
Three inputs set the rung:
- Severity in context. Start with the scanner score, then adjust for exploit signals and asset importance. The CVSS v4.0 FAQ says Base scores "are not risk" and should not be used alone for patch prioritization.
- Exposure. Internet-facing, internal only, or isolated.
- Duration. A 14 day exception and a 6 month exception are different decisions.
A sample ladder
The values below are an example to adapt, not a standard.
| Situation | Approver | Maximum duration |
|---|---|---|
| Low risk, internal asset | Engineering manager | Longer, with review |
| Medium risk, internal asset | Engineering manager and security reviewer | Medium |
| High risk, internal asset | Security lead and service owner | Short |
| High risk, internet-facing | Director or CISO, plus security lead | Shortest, with compensating controls |
| Exploited in the wild, any exposure | Executive risk owner, rarely granted | Days, not months |
Pick your own durations, and write them in the policy so that no one negotiates them case by case.
Rules that make the ladder hold
- Two people at minimum. The requester and the approver are different people. Read can the code owner approve their own exception.
- Approvers need the facts. The request should include the asset, exposure, exploit status, compensating controls and fix plan. The checklist in what to put in a security exception request covers it.
- Escalate on renewal. A second renewal goes one rung up. Repeated acceptance is a sign the problem needs funding, not another signature.
- Name a deputy. An approver on leave should not stall a release, and should not be bypassed by a private message either.
- Record the decision where the finding lives. The approval, date and expiry belong on the record, not in a chat thread.
What auditors tend to look at
Auditors usually want to see that the policy exists, that exceptions follow it, and that the approver had authority. A ladder written in advance answers all three. Do not call this a certification step. It is an internal control, and its value is that you can show it operating.
Where Safeguard fits
Safeguard policies and gates can require an approval and an expiry before a finding is waived, and keep the decision in an audit trail you can export for compliance evidence.
Quick check
Can security approve every exception on its own?
It is better not to. Security can advise and gate, but the person who owns the business risk should accept it, with security as a required reviewer.
Does the same ladder work for a startup with ten people?
Yes, compressed. Two rungs may be enough, such as a tech lead plus the founder or CTO for anything high risk.
Sources
Last reviewed: 19 October 2026.
