What to do when a cyber finding cannot be fixed immediately

When a cyber finding cannot be fixed immediately, the next step is an explicit decision about the exposure and what will happen in the meantime. Identify an accountable owner, consider practical ways to reduce the risk, and set a review point. Leaving the issue open without a decision does not make the exposure disappear.

Neither does formally accepting it. Risk acceptance records a decision to operate with an understood exposure; the decision itself does not remove a vulnerability or make an absent control work. That distinction should remain clear throughout the process.

Understand what is preventing remediation

Start with the finding and the affected environment. Establish what is missing or not operating, where the exposure exists, and what evidence supports the conclusion. If those points are unclear, resolve the uncertainty before treating a proposed exception as a workable response.

Then record the constraint. It may involve a vendor dependency, a production requirement, unavailable resources or a planned system replacement. Be specific about what must happen before remediation can proceed. A general statement that the business is too busy provides little basis for deciding how long the position should continue.

Consider what can reduce the exposure now

An immediate permanent fix may be unavailable while other changes remain possible. Depending on the finding, these might include narrowing access, limiting the affected system’s exposure or use, or improving visibility of relevant activity. Each option needs to be assessed in its actual operating context.

A compensating control should address the particular exposure, and its operation needs to be checked. Naming an alternative control is not enough. Record what it is expected to achieve, what it leaves unresolved and how the organisation will know it is operating.

Do not assume an internal risk acceptance or alternative control satisfies an applicable mandatory requirement. Check the relevant conditions and approval authority. If continued operation is not permitted, the organisation needs another course of action.

Record a decision that can be reviewed

A useful temporary exception record can be brief, provided it makes the decision and its limits clear. Include:

• Finding and scope: the affected systems, users or services, and the control gap.
• Constraint: why remediation cannot proceed immediately and the dependency that must change.
• Interim measures: what will reduce exposure, who operates each measure and how it will be checked.
• Residual exposure: what remains unresolved, including material uncertainty.
• Decision authority: who is accountable and who can approve the proposed temporary position.
• End or review point: the date, milestone or event that requires the decision to be revisited.
• Remediation route: the next action, its owner and how progress will be followed.

Review the conditions before extending an exception

Before a decision to extend an exception, a review should be conducted to test whether the basis for the original decision still holds. Has the environment changed? Are the interim controls operating? Has the expected remediation opportunity arrived? Has the exposure increased or become better understood?

An extension is another decision, with its own reasoning and accountable approval. Repeatedly moving the date can allow a temporary workaround to become an established dependency. If the organisation now relies on that arrangement, acknowledge the change and reassess it rather than continuing to describe it as temporary by habit.

Close the finding on a demonstrated outcome

When remediation is completed, confirm that it addresses the original finding across the relevant scope. Record the supporting evidence and identify any remaining gaps. A completed work item and a resolved finding are related, but they are not automatically the same conclusion.

Review whether the interim measures are still needed before removing them. If the finding remains open, make the next decision visible. The useful outcome is a position that the organisation understands, owns and revisits, with a credible route towards resolution.

Strategic Cyber’s Cyber Risk Advisory service can help clarify unresolved findings, treatment options and the governance decisions needed to move them forward.