This is a free browser tool on circuits.fit.
Track an exception, its owner, and its expiry. Known-exploited bugs, MFA, backups, and EDR are marked not waivable.
Every security program carries exceptions: a server that cannot take a patch until a vendor certifies it, a break-glass account without multi-factor sign-in, a laptop group where the endpoint agent conflicts with an old application. Exceptions are normal. Exceptions with no owner, no end date and no money behind the fix are how a temporary gap becomes permanent.
This register treats four controls as not waivable: a vulnerability on CISA’s Known Exploited Vulnerabilities catalog, multi-factor authentication, backups and endpoint detection and response. That is an editorial choice, not a legal rule. We chose those four because they are the controls attackers most often find missing, and because cyber insurers routinely ask about them on applications (see What a cyber insurer will still ask ). For federal civilian agencies, CISA’s BOD 26-04 already sets a three-day remediation clock, plus forensic triage, for the highest-risk catalog entries on internet-facing systems. A row in one of those four categories can still be recorded. It is labeled Not waivable so nobody mistakes the record for permission.
Not legal, tax, insurance, or procurement advice. Inputs stay in your browser. Nothing is uploaded.
Top comments (0)