For risk and compliance
Accept risk deliberately, and keep the record.
Not every finding should be fixed today, but every decision not to fix should be someone’s, on the record, with an end date. ACSE gives risk and compliance teams the controls to own those decisions, and a posture view that shows them honestly.
No forgotten exceptions
Every exception has a named owner and an expiry. When it lapses without recertification, the case reopens on its own.
Targets that mean something
Fix-by targets by severity and environment, with late cases listed and every change to a target recorded.
Frameworks that stay current
New framework versions arrive signed, with a changelog and a preview. You adopt them with a second person.
Exceptions
How an exception is earned
- RequestAn approver requests an exception from the case, instead of approving a fix.
- Own itA named risk owner, a person rather than a team, records the justification, compensating controls and review cadence.
- DecideThe exception is decided with step-up MFA and sealed to the evidence chain.
- Recertify or reopenBefore its recertification date, the owner re-earns it. If not, it lapses and the finding reopens.
Posture
See what is handled, and what is not
Attestations and accepted exceptions count as handled in the governed score. Exclusions leave its total. The raw score beside it never changes.
Accepted findings carry their own label and filter, so they stay visible without crowding the open queue.
Example tenant · 120 controls
Governed: what your team has handled
Raw: what the cloud says right now, never adjusted
Both scores are always shown together, so a better governed score can never hide what the cloud reports. Illustrative numbers.
What you own
The levers in your hands
Fix-by targets
Set and edit targets. Lengthening one needs a second person.
Framework adoption
Preview a new version side by side and adopt it with a second person.
Legal holds
Place a hold at once; release takes two people.
Reports and export
Executive reports and audit packages, with both scores named.
Questions
What people ask us
Can an exception last forever?
No. An exception lasts only as long as it is recertified. Without recertification it lapses and the case reopens.
Can we map our own risk framework?
Yes. Build a custom framework on ACSE’s checks. A second person publishes it, and it appears in reports and audit packages.
Who can approve an exception?
Only a Security Approver, with step-up MFA. Policy can also require the exception owner to be a different person.
Keep reading
Related
Approvals and governance
Every ACSE fix needs a person’s approval with step-up MFA, bound to the exact view they saw. Authors don’t approve their own changes, and two people where policy says.
ReadSolutionsAudit readiness
ACSE builds audit evidence as your team works: sealed cases, packages organized by control and a signed chain your auditor can verify offline on their own.
ReadACSEFrameworks
ACSE maps its cloud checks to CIS, PCI DSS, NIST 800-53, FedRAMP Moderate, CCCS Medium, ISO 27001 and SOC 2, with signed, versioned framework content.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.