RSK-03 · Risk and Decisions
Acceptances expire
Accepted risks and control exceptions carry an accountable executive, a compensating control and an expiry date.
0frameworks fully address it
5partially
3leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2PartialCC3.4 Implicit in risk response; expiry is not required.
- ISO 27001Partial6.1.3(f) Acceptance is required to be approved, not time-bound.
- NIST CSFPartialGV.RM-06 Expressed as risk response tracking.
- PCI DSSPartial12.3.3 Applies to compensating controls, reviewed annually.
- HIPAAAbsent No exception mechanism is defined; addressable specifications carry their own documented rationale instead.
- GDPRAbsent No concept of accepting non-compliance.
- EU AI ActAbsent No exception mechanism for high-risk obligations.
- NIST AI RMFPartialMANAGE 1.2 Risk acceptance is described but not time-bound.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Exception register with expiry and review outcomes.
?Why it exists
An acceptance without an end date is a decision nobody revisits.
For a smaller organizationThe founder accepts in writing and revisits every quarter.