|

Home
Platform
Seamless Integration with Cloud Platforms

PurpleWASP integrates with OneDrive, SharePoint, Google Drive, and Dropbox to manage policies where they already exist.

Solutions
Seamless Integration with Cloud Platforms

PurpleWASP centralizes policy workflows across your cloud drives.

Pricing
Partners
Maximize Your Potential with PurpleWASP

Whether you’re a technology partner or a reseller, we provide the tools, support, and resources for success.

PurpleWASP Risk Management guide
Featured guide
Create and assess a risk

Learn how to complete CIA and FAIR assessments, add controls, assign treatment actions and manage risk exceptions.

Read the guide
Risk Management guide

Manage risk exceptions and reassessments

Raise a formal exception for residual exposure above appetite, process the approval decision and create a new assessment version when conditions change.

Risk Manager or Risk Exception Approver Approximately 10–20 minutes Updated 27 July 2026

When an exception is required

If treatment leaves residual exposure above the organisation's risk appetite, PurpleWASP prevents the qualitative assessment from closing without either further reduction or a formal exception request.

Appetite is the decision boundary.

Tolerance does not automatically mean the risk can be closed. A result can be within tolerance and still require an approved exception because it remains above appetite.

1. Raise the exception

  1. Complete the treatment review.
  2. Select the action to complete the assessment.
  3. When prompted, choose to raise an exception rather than returning for more treatment.
  4. Record the justification, review period and required approver.
  5. Submit the exception.

The assessment becomes read-only while the exception decision is pending.

2. Approve or reject the request

A designated exception approver reviews the scenario, residual score, duration and justification in the Risk Exceptions Register.
ApproveAccepts the residual exposure for the defined scope and period and allows the assessment to close.
RejectReopens the assessment so the Risk Manager can add or strengthen treatment.
CloseEnds an exception according to the available governance workflow and recorded reason.

3. Reassess a completed risk

Use reassessment after a review period, material change, control implementation or new threat information.

  1. Open the completed risk and select Reassess Risk.
  2. Start the new assessment version.
  3. Review carried-forward vulnerabilities, threats and controls.
  4. Remove items that no longer apply and add new information.
  5. Complete evaluation and treatment using the current conditions.
A new assessment version begins from the prior residual position while preserving the completed previous version.

Version history

Previous assessments remain available as a stable record. Controls added during earlier treatment can become existing controls in the new version, making the effect of completed work visible.

Common problems

The assessment cannot be edited

Check whether an exception is pending. Editing is disabled until the approver decides.

A rejected exception did not close the risk

This is expected. Rejection reopens the assessment for additional treatment.