Re-evaluate an accepted risk
Use Re-evaluate accepted risk to review an existing Risk accepted decision when the acceptance approaches its expiration date or when changes to the vulnerability, affected release, deployment, or risk conditions require a new assessment.
Re-evaluation allows you to review and update the existing risk acceptance details rather than creating an unrelated decision. All changes to the risk decision are recorded in the Audit trail.
Opmerking
For a vulnerability with a Risk accepted decision, the available actions can include Reassign, Mark as invalid, and Accept risk for reevaluation. The actions available to you depend on your user role.
Ensure that:
The vulnerability has a Risk accepted decision.
You have reviewed the current vulnerability and affected release information.
You have current information to determine whether the existing technical justification and business rationale remain valid.
You have the appropriate permissions to reevaluate the risk. Available actions depend on your user role.
Navigate to Secure release > Repository tab.
Select repository name.
Select the Releases tab and select the release for which you want to re-evalute risk decision.
Select the Vulnerabilites tab.
Locate the vulnerability for which you want to re-evalute the Risk accepted decision.
Alternately, you can also navigate to Secure release> Monitoring dashboard > Vulnerabilities. . Locate the vulnerability with the Risk accepted decision. You can use the search functionality and configure the displayed columns to help locate the vulnerability. Select the alert name to open the vulnerability details.
Navigate to Secure release > Monitoring dashboard > Vulnerabilities.
Search and locate the vulnerability with the Risk accepted decision. You can use the search functionality and configure the displayed columns to help locate the vulnerability.
Select the Alert name for which you want to view the details.
Review the vulnerability details and the existing Risk accepted decision.
Confirm that the affected release, vulnerability information, and conditions under which the risk was originally accepted are still applicable.
Opmerking
If the vulnerability is currently suppressed, a suppression icon appears next to the Risk accepted decision.
From the vulnerability details, select Action > Accept risk (re-evaluate). For a vulnerability that already has a Risk accepted decision, the Accept risk (re-evalute) action is used to reevaluate the accepted risk.
The existing risk acceptance information is populated in the dialog so that you can review and modify it.
Review and update the following information as required:
Technical justification – Review and update the technical justification for continuing to accept the risk. A technical justification is mandatory.
Business rationale – Review and update the business reason for accepting the risk.
Suppress future scans for this vulnerability – Select or clear this option depending on whether the vulnerability should be suppressed from future scans.
Expiry/Revalidate date – Specify the date until which the acceptance or suppression remains valid.
Do not retain the previous justification without confirming that it remains applicable to the current risk conditions
Confirm the reevaluated risk.
Review the updated information and select Accept risk (re-evaluate). The vulnerability remains in the Risk accepted state with the updated risk acceptance details.
If suppression is selected, the suppression icon is displayed next to the risk decision.
Open the vulnerability's Audit trail and verify that the reevaluation and changes to the risk decision have been recorded. The audit trail maintains the history of actions associated with the vulnerability.