Treatment, Acceptance and Exceptions That Expire
Accepted risks that never expire become permanent holes. Make every acceptance name an owner, a compensating control and an end date.
What you'll be able to do
- Choose the right treatment for each risk
- Run an exception process leaders respect
- Tie every acceptance to an accountable executive and an expiry date
- Use compensating controls where a full fix isn't possible yet
A treatment plan and exception register
What's in it. A treatment plan and an exception register where every acceptance names an accountable executive, a compensating control and an expiry date.
You build it lesson by lesson, using your own organization, and submit it for your certificate. It's yours to keep and adapt.
Who it's for
Risk managers, security leaders and GRC analysts who handle exceptions.
What's inside
- Part 1Where the requirement comes from 16 min
- Part 2How small teams and enterprises meet it 14 min
- Part 3The method, step by step 20 min
- Part 4Hands-on lab: small team choose one 60 min
- Part 5Hands-on lab: enterprise choose one 120 min
- Part 6Finish and submit your deliverable 20 min
Built for your size
The requirement is the same everywhere. How you meet it depends on who you have. You pick the lab that matches your organization.
How you earn the certificate
Submit your finished deliverable, which is scored against a published rubric, and pass a short scenario quiz. Your certificate goes to your wallet and can be checked by anyone on the public register.