How to approve a risk acceptance request in the RiskSense platform.
The risk acceptance workflow serves as acknowledgment that after evaluating a vulnerability, the cost to remediate the vulnerability is larger than the risk posed by the vulnerability itself. For cases where an organization accepts a vulnerability’s risk, the RiskSense platform provides an option to mark that finding as a Risk Acceptance (RA).
Only managers and group managers can approve risk acceptance requests.
To approve a risk acceptance request, navigate to either the Network > Host Findings or Application > Application Findings pages. For this example, we will show you how to approve a risk acceptance using the Network > Host Findings page.
Select the RA Requested findings you want to approve by clicking the check box in the page’s first column. You may select several vulnerabilities at a time for approving risk acceptance. If you are having trouble finding risk acceptance requests, see Filtering for Risk Acceptance Requests.
Click the Workflow button.
In the Workflow drop-down menu, click Approve under the Risk Acceptance category. This option can be used for single and multiple vulnerabilities.
You may also select a single vulnerability and right click the line item to select workflow options from the pop-up menu. Note that using the right-click option only works for a single row, as designated in the screenshot below.
Clicking Workflow > Risk Acceptance > Approve brings up the Accept Vulnerabilities window.
The following list describes the fields that appear in the Accept Vulnerabilities window.
- Expiration Date: Date that the risk acceptance should expire. If the date is blank, the risk acceptance will not expire. You may enter your own expiration date or select one of the presets underneath the expiration date field.
- Override Expiration Date: If the requestor submitted an expiration date on the risk acceptance and you want to modify it, you must change the expiration date and click this check box.
Once the form is complete, click Submit. Once a manager approves a risk acceptance, the vulnerability state will change to RA Approved, as shown below.