Lion Cipher Lab
Build and age a security exception (risk-acceptance) register
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Every security program eventually meets a control it cannot satisfy on time -- a legacy system that will not take the patch, a vendor still on old TLS, an admin console that does not support multi-factor authentication yet. The grown-up answer is not to pretend the control is met and not to panic; it is a SECURITY EXCEPTION (also called a risk acceptance): a formal, written, TIME-BOXED record that says 'we know this requirement is not met, here is the leftover (residual) risk, here are the compensating controls that reduce it, here is the person accountable for it, and here is the date this…
What you'll learn
- defining a security exception (a formal, time-boxed record of an accepted deviation from a control requirement) and distinguishing it from a risk register, a POA&M, and a remediation SLA so you never conflate the four
- designing the register SCHEMA as a CSV: id, control deviated from, description, risk rating, compensating controls, risk owner, approver, approval date, review/EXPIRY date, and status -- and knowing why each field is load-bearing
- seeding a realistic register that contains the real-world defects auditors actually find: expired exceptions, missing risk owners, missing approvals, and missing compensating controls
- writing a pure standard-library Python aging tool (csv, datetime, collections -- no pip) that flags EXPIRED, DUE SOON, MISSING OWNER, MISSING APPROVAL, and MISSING COMPENSATING CONTROL per row
- computing a KRI (Key Risk Indicator) dashboard from the register: total open, percent overdue, mean age in days, counts by risk rating, and the count of 'temporary' exceptions older than a year
- pinning a fixed reference date (TODAY) inside the script so the report is deterministic and reproducible, and understanding why that matters for a check you can re-run and defend
- producing a before/after result: a remediation-and-renewal pass takes the register from 5 expired / 41.7% overdue / KRI RED to 0 expired / 0.0% / KRI GREEN, with mean age falling from 324.9 to 119.7 days
- carrying the core judgment that an exception is a legitimate risk-management tool, not a loophole -- every one needs an accountable owner, documented compensating controls, and a hard expiry, and a stale or expired exception is itself an audit finding
Steps in this lab
- What a security exception is -- every term, defined once
- What it is NOT: risk register vs POA&M vs SLA -- and why that matters
- Design the register SCHEMA
- Seed a realistic register -- clean rows and real defects
- Write the aging tool and pin 'today'
- Measure the BEFORE register
- Remediate and renew -- measure the AFTER register
- When an exception is the right call -- and when it is a cop-out
- What you built -- and the reflex to keep