# Manage an exemption

Define the target, justification, accepted risk and validity period.

> **Access:** organization administrator. Subject to enabled modules and your plan.

## Prerequisites

Exemptions are available to organization administrators when the module is enabled. Prepare the target, business justification and compensating controls.

## Create an exemption

1. Open **Registers → Exemptions**, then **New exemption**.
2. Choose the target type and affected item.
3. Enter **Title**, **Business rationale** and **Countervailing measure**.
4. Set start and end dates, then the next review if needed.
5. Link an existing risk or describe the accepted risk and severity. A risk target is linked automatically.
6. Check the details and select **New exemption**.

![Exemption form](https://docs.cisapp.eu/images/en/exemptions.webp)

*Justification, risk and duration make the decision reviewable. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/exemptions.webp)*

## Track deadlines

Combine status, target and deadline filters in the register. Use **Expires within 30 days** to prepare reviews. Open details and review available actions to follow the decision lifecycle.

## Date errors

The end must follow the start and respect the maximum duration displayed by the interface. The review date must precede the end date. Correct highlighted fields before confirming.

## Expected outcome

The decision is recorded with a target, justification and deadline. An exemption does not prove that the gap has been fixed: keep tracking controls and the associated risk.