Request a deviation

Use this when a vulnerability genuinely cannot be fixed within its SLA — the fix needs a vendor release, a change freeze is in force, or the remediation carries more risk than the finding does.

Before you raise one

Be able to answer three questions. An approver will ask all of them.

1. Why can it not be fixed now? A specific reason, not "no capacity".
2. What reduces the risk meanwhile? Compensating controls — restricted access, additional monitoring, network segmentation.
3. When will it be fixed? A date you can defend, not an open-ended extension.

Raising the request

1. Open the vulnerability.
2. Choose the option to request a deviation or risk acceptance.
3. Complete:
   • Justification — the answers to the three questions above.
   • Valid until — the date the acceptance should lapse.
   • Compensating controls — what is in place meanwhile.
4. Submit.

The request routes to an approver automatically, based on severity. More severe findings require more senior approval.

Deviation Management → Deviations — every request, its state and the finding behind it

Which approver a request reaches is not decided per request: it follows the designation and approval-level configuration held under Deviation Management.

Deviation Management → Approval Configuration — which designation approves which severity

After submitting

Outcome	What happens
Approved	The finding is covered until the end date
Rejected	It returns to normal tracking; remediate it
Expired	The end date has passed; it appears in the Expired list

The vulnerability stays open throughout

A deviation does not close a finding or remove it from open counts. It records why nothing is being done yet. The weakness is still there, and NxSAM still reports it as an exposure.

This surprises people who expect an approved deviation to clear the number. It does not, deliberately.

When it expires

Nothing prompts you. The date passes and the finding appears in Expired Vulnerabilities.

You then either:

• Remediate it — the intended outcome, and the reason the deviation was time-limited.
• Renew it — if circumstances genuinely have not changed. Renewal is a fresh request with a fresh end date and fresh approval, not an extension.

Review the Expired list on a schedule. Items arrive there without anyone acting, so nothing draws attention to them.

Deviation Management → Expired Vulnerabilities — acceptances whose end date has passed

Good practice

• Keep periods short. A three-month deviation reviewed on time is better governance than a two-year one nobody revisits.
• Be specific in the justification. It will be read by an auditor eventually, possibly long after everyone involved has forgotten the context.
• Do not use deviations for false positives. If the finding is not real, mark it a false positive. A deviation says "this is real and we accept it" — a materially different statement.