GRC › Module 3 › Lesson 3
Acceptance Hygiene
Acceptance hygiene literacy names approver, expiry, residual score, and re-review triggers — document acceptance rows on YOUR $GRC_LAB when treatment option is accept.
Visual · t37_acceptance_hygiene
Acceptance hygiene literacy. $GRC_LAB only. Original Cyberlium.
Opening
Accept without approver is audit failure — literacy teaches acceptance hygiene so fictional org decisions on $GRC_LAB stay defensible under sampling.
Risk acceptance requires named approver with authority, acceptance date, documented residual score within appetite, business rationale, expiry or re-review date, and trigger for reassessment — e.g., new threat intel or system change. Silent or expired acceptances fail internal and external audit questions. Cyberlium writes acceptance row on YOUR $GRC_LAB — risk ID, approver role, residual, rationale, expiry for one fictional Accepted risk. Next: Treatment Lab.
1. Acceptance fields (named)
Approver: role with authority — fictional CISO or business owner on YOUR lab org. Residual: scored within appetite band. Rationale: why accept vs mitigate. Expiry: date or event triggering re-review. Trigger: major change forces reassessment.
On $GRC_LAB, write acceptance row — all required fields for one fictional Accepted risk.
Command guide
Try these commands — Acceptance fields (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
ISO 27001 — https://www.iso.org/isoiec-27001-information-security.html ISACA — https://www.isaca.org/resources/glossary NIST CSF — https://www.nist.gov/cyberframework
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
cat > "$GRC_LAB/notes/risk-acceptance-hygiene.md" <<'EOF'
# Risk Acceptance Hygiene — LAB-ORG-001
## Required fields for Accept decisions
- Risk ID + residual score after controls
- Business justification (why accept vs mitigate)
- Approver role (e.g. CISO + business owner) — fictional names OK in lab
- Expiry/review date — acceptance is time-bound
- Compensating controls if any
## Anti-patterns (refuse in real programs)
- Permanent accept without review
- Accept to avoid budget — undocumented
- Accept regulatory risks without legal sign-off
## Lab rule
- R-006 in risk-register.csv demonstrates time-bound accept with decommission plan
EOFCommand — copy this
grep -E 'Accept|review date|R-006|Anti-patterns' "$GRC_LAB/notes/risk-acceptance-hygiene.md" grep Accept "$GRC_RISK/risk-register.csv"
Primary tools to practice this lesson: grep, python3. Reference sites: ISO 27001 (https://www.iso.org/isoiec-27001-information-security.html); ISACA (https://www.isaca.org/resources/glossary); NIST CSF (https://www.nist.gov/cyberframework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why acceptance hygiene prevents audit findings
Auditors ask 'who approved this High residual?' — missing name fails. Expired acceptances treated as open risks until renewed. Appetite drift without re-review leaves stale decisions on registers.
Students document lab acceptance on notes — production acceptance follows delegated authority matrices.
3. Lab boundary
Forbidden: forging executive signatures on lab acceptance rows. Allowed: acceptance hygiene card — fictional approver role with $GRC_LAB example.
Ship: acceptance row for YOUR lab Accepted risk. Next: Treatment Lab.
4. What you ship: acceptance row for $GRC_LAB
Approver, residual, rationale, expiry. $GRC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Acceptance row. $GRC_LAB named. File t37-m03-l03-acceptance-hygiene.txt chmod 600.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Accept High risk with no approver named. Set expiry never because 'permanent accept.'
Right
Write acceptance row for YOUR $GRC_LAB. Next: Treatment Lab.
Mission: document acceptance hygiene on YOUR lab
1) Pick one fictional risk to accept. 2) Name approver role and residual score. 3) Write rationale and expiry date. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Expiry dates force re-review — permanent accept without trigger is audit red flag.
Knowledge Check
APPLY: Risk acceptance hygiene requires:
Multiple choice
Knowledge Check
APPLY: True or False: Expired acceptance should trigger reassessment.
True or False
Knowledge Check
APPLY: Acceptance hygiene on Cyberlium uses:
Multiple choice