Skip to content

Residual Hotspot Exception Review

Risk-acceptance review — instantiates Vulnerability Hotspot Mapping and Hardening

Formally reviews the hotspots that cannot be fully fixed and signs off the leftover risk — with compensating controls and an expiry — instead of letting it hide.

Some hotspots cannot be hardened enough — physics, cost, or time will not allow it. The dangerous move is to quietly leave them and hope. Residual Hotspot Exception Review is the governance ritual that makes the leftover risk explicit: it convenes owners to state the residual risk on each un-fixable hotspot, attach compensating controls, and grant a time-boxed, signed exception — and it refuses to accept a residual on any unit the equity floor says must be protected. Its defining move is to convert silent, un-fixed risk into an owned, documented, expiring decision. Where an equity impact review audits the fairness of the whole allocation, this reviews the specific residual hotspots and formally accepts or refuses each one.

Example

A hospital's security team finds an infusion-pump model running an unpatchable legacy operating system — a genuine hotspot that cannot be eliminated (the vendor is gone) or cheaply replaced (a capital cycle away). Rather than ignore it, the review states the residual risk plainly, records compensating controls (segmenting the pumps onto an isolated network, extra monitoring, a replacement funded for next budget year), and issues a risk acceptance signed by a named executive owner with a 12-month expiry — after which it must be re-reviewed, not silently renewed. The review also checks the equity angle: it will not accept leaving a pediatric ICU exposed merely because the fix is inconvenient — that unit sits under the non-abandonment floor, so the residual there is refused and a nearer-term fix forced instead.

How it works

  • State the residual, don't bury it. Write down what risk remains after the feasible hardening, in plain terms and with its uncertainty, so "too hard to fix" cannot silently become "ignored."
  • Require compensating controls and an owner. No exception is granted without mitigations, a named accountable owner, and an expiry that forces re-review rather than indefinite drift.
  • Enforce the non-abandonment floor. Refuse to accept residuals on units the equity floor protects, however costly the fix, converting the refusal into pressure for a real one.

Tuning parameters

  • Acceptance authority — how senior the sign-off must be, scaled to residual severity. Higher bars slow throughput but stop casual acceptance.
  • Expiry length — how long an exception lives before mandatory re-review. Shorter keeps the pressure on; longer reduces churn but risks fossilizing a risk everyone forgot.
  • Compensating-control bar — how much mitigation is required before a residual can be accepted at all.
  • Floor strictness — which units are simply non-abandonable and cannot be granted an exception regardless of cost.

When it helps, and when it misleads

Its strength is that it drags un-fixable risk into daylight with an owner, a mitigation, and a clock, and it stops "too hard to fix" from silently becoming "ignored forever."

Its classic abuse is the rubber-stamp exception — risk acceptance used to retire a problem on paper rather than manage it, then auto-renewed past its expiry until everyone forgets it was ever accepted.[1] The discipline that guards against it is to tie every exception to a named owner, a hard expiry, and a re-review that is genuinely empowered to refuse renewal — and to keep the exception register visible rather than buried.

How it implements the components

Residual Hotspot Exception Review fills the residual-risk-governance components — the ones that account for what hardening could not remove:

  • residual_hotspot_risk_statement — it produces the explicit statement of risk remaining after feasible hardening, with its uncertainty attached.
  • equity_floor_and_non_abandonment_guardrail — it enforces, case by case, that residuals cannot be accepted on units the floor protects.

It does not rank or resource the hotspots (hotspot_priority_rule, resource_targeting_policy — Resource Allocation Rebalancing) and it does not do the hardening; where a residual is refused, it routes the hotspot back to Targeted Hardening Sprint. Equity Impact Review applies the same non-abandonment principle at whole-portfolio scale, where this review applies it one exception at a time.

Notes

An exception is not a fix, and an exception register that only grows is itself a hotspot — a pile of accepted risk drifting past its expiries. The register has to be worked down, with renewals treated as failures to resolve rather than routine paperwork.

References

[1] Risk acceptance with compensating controls — the formal practice, as in ISO/IEC 27005 and similar risk-management frameworks, of documenting a residual risk, its mitigations, and an accountable owner rather than treating "unresolved" as "invisible." The expiry and mandatory re-review are what separate managing a residual from quietly forgetting it. ↩