A critical library catalog finding will not be fixed this quarter due to a vendor dependency. How should that decision be handled?
Select an answer to reveal the explanation.
Short Explanation
Can't fix it yet? Don't ghost the ticket—write an exception with an end date and a revisit. Silent deletes, fake 'fixed' labels, or public forever-accepts are how risk acceptance goes sideways.
Full Explanation
When remediation is deferred, exception handling requires documented risk acceptance with time bounds and scheduled review. A critical library catalog finding blocked by a vendor dependency cannot simply vanish; the city must record who accepted the risk, why, which compensating controls apply, an expiry date, and when the exception will be revisited. That discipline keeps residual risk visible to governance instead of hiding it in a forgotten tracker.
Silently ignoring the finding and deleting it from trackers destroys accountability and audit evidence. Marking the finding closed as ‘fixed’ without any change is falsification of remediation status. Announcing on social media that the library accepts all vulnerabilities indefinitely is uncontrolled, open-ended acceptance without governance and creates unnecessary public and legal exposure.
Exam caveat: Risk acceptance is a formal, time-bounded management decision—not silent deletion, fake closure, or perpetual public waiver. Exam stems about deferred fixes usually want documented exceptions with review dates.
Operational check: Open an exception record tied to the catalog finding, obtain documented acceptance from an authorized risk owner, list compensating controls, set expiry before the next quarter’s review, and auto-reopen the finding if the vendor fix still has not landed at expiry.