Does your organization have a process to periodically review previously accepted risks that were deferred based on planned future actions or milestones?

Organizations often accept certain security risks temporarily with the intention to address them at a future date when resources become available or when planned system changes occur. Without a systematic review process, these temporarily accepted risks may be forgotten and remain unaddressed indefinitely, potentially creating security vulnerabilities. Regular reviews ensure that accepted risks don't become permanent fixtures in your security posture and that planned mitigations are implemented according to schedule. Evidence of fulfillment could include a risk register or tracking system that shows dates of risk acceptance, planned mitigation dates, review dates, and status updates. Documentation of periodic risk review meetings, including minutes that specifically address the status of previously accepted risks, would also serve as appropriate evidence.