This template is part of the vulnerability exception renewal guide. Fill in the blank version with the risk owner, compare it with the completed example, and let the risk owner forward it to the executive.
Ground rules for a brief about security records
Exception records are more sensitive than most operational data, because each one describes a weakness the company knowingly left open for a while. Four rules keep the brief safe to forward:
- Counts and categories only. "About 1,900 exceptions" is useful. "The payment gateway runs an unsupported library" is a disclosure.
- Tools by plain name. Write "scanner", "GRC platform" or the product name as text. No screenshots, report extracts or dashboard links.
- Estimates are labelled. Write whose estimate it is. The risk owner's guess is fine as long as it is marked as one.
- Two people, two lines. The person who knows the records and the person who can authorize a discussion are rarely the same. The who-can-say-yes decision tree helps tell them apart.
The blank brief
Copy this table into an email or document. Every field should take one or two lines.
| Field | What to write | Who usually knows |
|---|---|---|
| 1. Company | Sector, country, full-time headcount at peak (contractors excluded) | Website, risk owner |
| 2. Business task | One sentence on how exceptions are requested, approved, renewed and closed | Risk owner |
| 3. Record classes | Which exist: requests, approvals, renewals, control evidence, closures, policy versions | Risk owner, GRC lead |
| 4. Systems | Scanner, GRC platform, ticketing or change tool; which one is being retired | GRC lead |
| 5. Span and volume | First year of records; rough total exceptions; share renewed at least once | Risk owner (estimate) |
| 6. Renewal linkage | Does each renewal point back to the original acceptance and its control proof? | GRC lead |
| 7. Access deadline | Date the retiring platform turns read-only or is switched off, and who confirmed it | Project plan |
| 8. Client or regulator factors | Do exceptions cover client systems? Any regulator-facing use? | Risk owner, counsel later |
| 9. Records owner and authorized contact | Executive who owns the records; the person who agreed to an introduction | Risk owner, then that executive |
| 10. Open question | One thing the records might show that nobody has checked | Your conversation |
Field 6 matters most. Tools handle renewal differently: Microsoft documents that an exception's duration cannot be extended, so continuing one means creating a new exception, while Tenable's accept rules simply expire on a set day or date. Either way, whether renewals still link to the first decision is the question a reviewer will ask first.
Completed example (Illustrative)
Invented for this page. The company, counts and dates are fictional and show the level of detail, not a real opportunity.
| Field | Completed entry |
|---|---|
| 1. Company | Payments software provider, Canada and U.S., 610 full-time employees |
| 2. Business task | Teams request exceptions for findings they cannot fix within policy deadlines; the CISO approves for 90 days; each renewal needs fresh control evidence |
| 3. Record classes | Requests, approvals, renewals, firewall and segmentation change tickets, closure notes, five versions of the exception policy |
| 4. Systems | A vulnerability scanner, a GRC platform being retired, a change management tool; a new risk platform is replacing the GRC platform |
| 5. Span and volume | Since 2019; around 1,900 exceptions over seven years, about a third renewed at least once (risk owner's estimate) |
| 6. Renewal linkage | Renewals are separate records in the GRC platform; risk owner thinks most cite the original, but early years are uncertain |
| 7. Access deadline | GRC platform becomes read-only next March, per the migration plan the GRC lead shared verbally |
| 8. Client or regulator factors | Own platform only; no client systems; exceptions summarized for auditors yearly |
| 9. Records owner and authorized contact | CISO knows the records; the CEO can authorize licensing and agreed to a 20-minute call; general counsel to advise |
| 10. Open question | When a renewal was approved, was the compensating control re-tested, or only re-described? |
Why it works. Every entry describes the records without reproducing any of them. Field 5 is marked as an estimate. Field 7 names a documented event rather than a vague "soon". Field 10 ties to a real gap that NIST's patch guidance points at: organizations should verify that added controls actually work, and a renewal history either shows that verification or shows it was skipped. Both answers are informative.
The client opportunity brief generator can reformat these answers, and the warm introduction brief shows a covering note for the executive.
Lines that never go in the brief
- Vulnerability identifiers, scanner findings or severity lists
- Asset names, hostnames, IP ranges or network diagrams
- The wording of any compensating control or firewall rule
- Audit reports, insurance questionnaire answers or penetration test results
- Logins, API tokens or an invitation to view the GRC platform
- A guess at what the records are worth
If someone offers any of these, decline politely. Security teams used to vendor reviews will recognize the instinct from vendor due diligence: share only what the reviewer needs, under the company's own controls. If the company is also mid-way through a cyber insurance renewal questionnaire, keep that process separate.
Before you press send
- Qualification. The company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.
- Agreement. Partners sign the Channel Partner Agreement before submitting introductions.
- Attribution. The first valid introduction within the 90-day window is credited when the company submits a verified application.
What stays unknown until SourceX reviews the opportunity: which records the company may license, how security-sensitive detail would be removed, buyer interest and any terms.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
When every field is filled from conversation and the executive in field 9 has agreed to talk, register as a partner, check the company against who qualifies and read the program terms before you submit the brief.