Closing an End-of-Life ERP Risk as 'Mitigated'
You are the CISO of a 3,200-employee manufacturer. The ERP that processes roughly $40 million in monthly payments runs on Windows Server 2012 R2, which has been out of vendor support for eleven months; its replacement is funded but will not cut over for fourteen months. A penetration test two months ago found an unauthenticated remote code execution vulnerability (CVSS 9.8) reachable from the corporate VLAN. The only mitigations in place are a WAF virtual patch and an ACL limiting access to 180 finance users plus one middleware host. The business owner has signed a request to close the risk register entry as 'mitigated' until cutover, citing the WAF and the absence of internet exposure. Internal audit refuses to accept closure and has escalated to the board risk committee, which meets in ten days. The risk appetite statement says: 'No unmitigated critical vulnerabilities on systems processing financial transactions.' The same WAF was bypassed twice in the past year on other applications.
1. Should the risk register entry be closed as 'mitigated'? Justify your answer using inherent versus residual risk, control effectiveness, and risk appetite.
Read the worked answer
No. Closing the entry as 'mitigated' confuses treating a risk with eliminating it. The vulnerability is still present and remotely reachable; the WAF and ACL are compensating controls, not a fix. Control effectiveness is the deciding factor: a virtual patch that has been bypassed twice in a year on other applications is not reliable enough for a CVSS 9.8 flaw on a system moving $40 million a month. The residual risk therefore remains high and conflicts directly with the stated appetite, which prohibits unmitigated critical vulnerabilities on payment systems. The correct register record is: inherent risk critical, current residual risk high, treatment 'mitigate' with a dated plan, and a named accountable executive. The business owner may own the business process, but acceptance authority for a critical risk normally sits with the CISO plus the board risk committee, as defined in the risk management framework. Audit is right to challenge the closure, although audit should not become the risk owner.
2. The board risk committee asks for a decision paper. What options should it contain, which do you recommend, and at what authority level must the residual risk be accepted?
Read the worked answer
Options: (A) close as mitigated - reject; (B) time-bound risk acceptance with stronger compensating controls and board approval - recommend; (C) isolate the ERP on a dedicated segment and accelerate cutover, accepting reduced functionality; (D) suspend or re-platform payments - not viable. Recommend B only if combined with elements of C. Conditions: dedicated VLAN with deny-by-default to the ERP, EDR on the server and middleware host, 24/7 monitoring with alerting on the WAF and server, independent WAF bypass test within 14 days, weekly authenticated scans, vendor extended-support contract, and cutover milestone gates every 60 days. The acceptance should expire in 90 days and be re-approved at each gate. Residual risk must be accepted in writing by the board risk committee or the accountable executive designated in the framework, not by the business owner alone. State explicitly that this is 'accept with conditions,' not 'mitigated,' and record the acceptance in the risk register.
3. What evidence and re-review conditions would you attach to a time-bound exception?
Read the worked answer
Evidence: independent test results for every WAF rule protecting the vulnerable endpoint, current ACL and network flow review, SIEM coverage showing WAF, server, and authentication logs, a documented escalation path, and confirmation that the replacement project has funding and a baseline schedule. Re-review triggers: any WAF bypass, publication of a new exploit or proof-of-concept, a critical patch released by the extended-support vendor, cutover slipping more than 30 days, or a change to the ACL. Re-review cadence should be 30/60/90 days. Each review should record whether residual risk is unchanged, increased, or reduced. If the replacement slips beyond the agreed gate, the exception should lapse automatically and the board should have to decide again - that prevents a temporary acceptance from becoming permanent by default.