Patch exception records

Name: Patch exception records
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Identifies patch and vulnerability exception records (deferrals, waivers, exemptions) that name affected assets, deferred patches/CVEs, expiry dates or approvers. Generic risk register, asset owner and remediation plan wording no longer matches.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: exception wording is discovery-only; enforcement requires asset, patch reference, expiry or approver structure, and 85 adds a second structure and justification context.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: Essential Eight, ISO 27001, NIST CSF
Data categories: security, technology
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:patch(?:ing)?\s+(?:exception|deferral|waiver|exemption)s?(?:\s+(?:request|record|register|form)s?)?|vulnerability\s+(?:exception|waiver|remediation\s+exception)s?|security\s+exception\s+(?:request|record|register)s?|remediation\s+(?:exception|deferral)s?)\b

Corroborative evidence keywords

compensating control, risk acceptance, network segmentation, end of support, business justification

Proximity: 300 characters

Should match

Patch exception request - SCADA historian Asset: hist01.ot.example.internal (10.12.5.20) Deferred patches: KB5034441, CVE-2024-21412 Business justification: vendor certification for the historian build is pending until the March outage. Compensating control: host isolated in the OT DMZ with application control enforced. Approved by: Renee Caldwell (risk owner) Expiry date: 31/03/2027 — High tier (85) - asset host/IP, deferred KB/CVE, approver and expiry with compensating control justification
Vulnerability exception for the legacy kiosk: expires 30/06/2027, reviewed quarterly by the service owner. — Medium tier (75) - expiry date only
Patch deferral record - KB5031356 held back on the finance terminal servers. — Medium tier (75) - patch reference only
The patch exception register is reviewed at the monthly security meeting. — Discovery tier (65) - exception wording only

Should not match

The asset owner updated the risk register. — Generic risk/asset wording is no longer a primary
Policy statement: a patch exception must be approved by the CISO and reviewed every 90 days; this policy requires compensating controls. — Policy text
Patch exception form template Asset: ______ CVE: ______ Approved by: ______ Expiry date: ______ — Blank template
News report: the auditor found agencies had open patch exceptions with no compensating controls, reviewed 01/07/2026. — News framing

Known false positives

Patch management policies and audit reports describe exception processes and approval requirements. Mitigation: Exception wording is discovery-only; enforcement needs asset, patch, expiry or approver structure, and policy/news/template framing is excluded.