Tool

Risk exception register

Track an exception, its owner, and its expiry. Known-exploited bugs, MFA, backups, and EDR are marked not waivable.

Not legal, tax, insurance, or procurement advice. Inputs stay in your browser. Nothing is uploaded.

Exceptions for a CISA Known Exploited Vulnerability, MFA, backups, or EDR are marked Not waivable. A row is also flagged when it has no owner, no expiry, or no funded fix, and when the expiry is past or inside 30 days. The file import is read in this browser. It is not uploaded.

Showing the example. Replace it with your register.

Swipe the table sideways to see every column.

Exceptions, who accepted them, and when they expire
Control or finding System Owner Reason Compensating control Funded Amount Expiry Accepted by Status

Output

The register summary appears here.

How to use this

  1. Replace the example rows. Pick CISA KEV, MFA, Backups, or EDR when the exception is one of those. Those four stay Not waivable.
  2. Give every other row an owner, an expiry, and a funded amount above zero. A blank expiry or a no on funding stays flagged.
  3. Export the CSV for a copy. Import reads a file on this device and does not send it anywhere.

Related