---
title: Exception Management
slug: solutions/exception-management
docTags: 
createdAt: 2025-08-11T11:13:45.687Z
---

To define a systematic approach for managing and documenting exceptions to identified vulnerabilities that deviate from established remediation protocols.

Key Elements of a Vulnerability Exception:

- **Exception Name:** A descriptive title summarizing the exception.
- **Description:** A detailed explanation of the exception, including its scope and impact.
- **Identifiers**
  - **Asset IDs:** Identifies the resources impacted by this exception. Use \* for wildcard.
  - **Vulnerability IDs:** Specific vulnerabilities covered by this exception. Use \* for wildcard.
  - **Zone IDs:** Resource zones impacted. Use \* for wildcard.
- **Risk Scoring**
  - **Turbine Risk Score Range:** Defines the range of scores for the vulnerabilities affected. Use -1 for wildcards.
    - **Minimum**: 0
    - **Maximum**: 1000
  - **CVSS Base Score Range:** Minimum and Maximum CVSS Scores for covered vulnerabilities, using -1 for wildcards.
- **Ownership:** The individual responsible for the exception, including contact information.
- **Expiration:** Defines a clear timeline for the exception, including an expiration date
- **Reason:** Documented rationale for granting the exception (for example, operational necessity, low risk, and so on).
- **Status:** Tracks the current state of the exception (Active/Inactive).

All of the above field are REQUIRED in order to create an exception. Exceptions are evaluated whenever a finding is ingested into the Turbine platform, or when re-enrichment is triggered from the Vulnerability Finding application.

![](https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/80XOAAlx12HXtGg3rZYyr_vrm-exception.png)