Risk Acceptance

Use the Risk Acceptance management page to:

• See high-priority accepted risks sorted by their acceptance date to re-accept, extend the date, add notes, or revoke acceptance.
• Re-accept an expired accepted risk because it is still relevant.
• Revoke an accepted risk to mark the affected policies to remove the acceptance and re-evaluate the affected resources.
• Edit the expiration date to postpone it.

Risk Acceptance for Posture

Prerequisites

• Sysdig Secure SaaS with the current Compliance module

• A role with permission to read or edit

  For context, you can review how to accept risk on an entire control or a specific resource in posture/compliance findings.

Usage

1. Log in to Sysdig Secure and select Policies > Risk Acceptance > Posture.

   

   • Ensure you have the required permission: Posture, Risk Acceptance (read or edit)

   • Accepted compliance risks are displayed in order of acceptance date

2. Filter results by:

   • Context: Free text search on relevant terms such as the Platform, Control Name, and Resource Name. Global acceptances have the context All Resources.

   • Reason: Risk Owned, Transferred, Avoided, Mitigated, Not Relevant, Sysdig Accepted Risk, or Custom.

     Note that Sysdig Accepted Risks are autogenerated, and an explanation is included in the hover-over tooltip.

   • User: View acceptances by who created them

   • Expired/Active: Note that the table can be sorted by expiration or acceptance date, ascending or descending

3. Select an entry to open its detail drawer and:

   • Revoke an acceptance
   • Edit the Reason or Expiration details
   • Ensure you have the required permission: Posture, Risk Acceptance - edit.

Risk Acceptance for Vulnerabilities

Prerequisites

Review Understanding Risk Acceptance for Vulnerabilities for a full overview of how this feature is used for vulnerability findings, including:

• Enablement prerequisites
• Types of risk assessed
• How to use in Pipeline and Runtime scan results

Use the Accept Risk > Vulnerabilities panel to review acceptances that are expired or close to expiry and manage them.

Usage

1. Log in to Sysdig Secure.

2. Select Policies > Risk Acceptance > Vulnerabilities.

   Any vulnerabilities that were risk-accepted are displayed, in order of acceptance date.

   

3. Filter results by:

   • Search: Free text search on relevant terms such as the image name, package name, and CVE ID.
   • Entity: You can filter by Vulnerabilities, Image name, Host name, and Policy Rule.
   • Reason: Filter by Risk Avoided, Risk Owned, Risk Transferred, Risk Avoided, Risk Mitigated, Risk Not Relevant, or Custom.
   • Expired: Filter by expired Risks that were accepted. You can sort the table by expiration or acceptance date, ascending or descending.
   • Active: Shows all the active Risks that are accepted. You can sort the table by expiration or acceptance date, ascending or descending.

4. Select an entry to open its detail panel to:

   • Revoke an acceptance
   • Edit the Reason and Expiration details of an accepted Risk.

Note: When an acceptance expires, it no longer excludes the vulnerability from the vulnerability count.