Override reasons

Describes the reasons you can select when you override a compliance rule result.

When you override a rule result, you select one of these reasons and provide a free-text justification.

Reason Description
Compensating control Another control in place achieves the same security outcome as the failed rule.
Risk accepted Your organization accepts the risk of the failed rule.
False positive The rule result is incorrect.
Vendor exception The vendor of the affected system has approved an exception to the rule.
Policy stricter than benchmark Your organization's own policy is already stricter than the rule requires.
Other None of the other reasons apply. Use the justification field to explain why.