Request an exception using GRC: Policy and Compliance Management
Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Vulnerability Response.
Before you begin
Download the GRC: Policy and Compliance Management application from the ServiceNow Store to use the Policy Exception Integration to request policy exceptions.
Role required: sn_vul.remediation_owner and one of the following:
- sn_grc.business_user (GRC business user)
- sn_grc.business_user_lite (GRC business user – lite)
- sn_compliance.policy_exception_employee_user
Note: Check your entitlements to determine whether you have access to these roles.
Procedure
-
Navigate to Workspaces > Security Exposure Management > findings (or Remediation Tasks)>All, and open the item or group for which you want to request an exception.
The selected item or group must be in Open, Under investigation, or Awaiting implementation state.
-
On the selected form, click Request Exception.
-
On the form, fill in the fields.
|
Field |
Description |
|---|---|
|
Policy |
Vulnerability Management policy that you are requesting an exception for. |
|
Control objective |
Control objectives that are associated with the policy you selected. If a policy is not selected, all the control objectives are listed. |
|
Valid from |
Date when the exception will start. The default value is the current date. This date cannot be in the past. |
|
Valid until |
Date that the policy exception expires and the state of the vulnerable item or group changes from Deferred to Open.Note: The number of days that the policy exception is valid cannot exceed the Maximum exception duration (days) that you set for the policy in Policy and Compliance. For more information, see Create a policy. |
|
Reason |
Reason for requesting an exception. |
|
Justification |
Details that are related to the reason why this request is being made. This mandatory field must be filled in by the remediation owner. |
For more information on the Policy Exception Integration and the hand-off between the remediation owner and the compliance manager, see [Policy and Compliance optional setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/policy-compliance-optional-steps.md).
---
title: Request an exception using GRC: Policy and Compliance Management
description: Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Vulnerability Response.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/sem-integration-with-grc.html
release: brazil
topic_type: task
last_updated: "2026-11-06"
reading_time_minutes: 1
breadcrumb: [Configure Exception Management for Security Exposure Management, Implement, Unified Security Exposure Management, Security Operations]
---
# Request an exception using GRC: Policy and Compliance Management
Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Vulnerability Response.
## Before you begin
Download the GRC: Policy and Compliance Management application from the ServiceNow Store to use the Policy Exception Integration to request policy exceptions.
Role required: sn\_vul.remediation\_owner and one of the following:
- sn\_grc.business\_user \(GRC business user\)
- sn\_grc.business\_user\_lite \(GRC business user – lite\)
- sn\_compliance.policy\_exception\_employee\_user
**Note:** Check your entitlements to determine whether you have access to these roles.
## Procedure
1. Navigate to **Workspaces** > **Security Exposure Management** > **findings** \(or **Remediation Tasks**\)>**All**, and open the item or group for which you want to request an exception.
The selected item or group must be in Open, Under investigation, or Awaiting implementation state.
2. On the selected form, click **Request Exception**.
3. On the form, fill in the fields.
<table id="table_stm_xty_flb"><thead><tr><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td>
Policy
</td><td>
Vulnerability Management policy that you are requesting an exception for.
</td></tr><tr><td>
Control objective
</td><td>
Control objectives that are associated with the policy you selected. If a policy is not selected, all the control objectives are listed.
</td></tr><tr><td>
Valid from
</td><td>
Date when the exception will start. The default value is the current date. This date cannot be in the past.
</td></tr><tr><td>
Valid until
</td><td>
Date that the policy exception expires and the state of the vulnerable item or group changes from Deferred to Open.**Note:** The number of days that the policy exception is valid cannot exceed the **Maximum exception duration \(days\)** that you set for the policy in Policy and Compliance. For more information, see [Create a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/t_DefineAPolicy.md).
</td></tr><tr><td>
Reason
</td><td>
Reason for requesting an exception.
</td></tr><tr><td>
Justification
</td><td>
Details that are related to the reason why this request is being made. This mandatory field must be filled in by the remediation owner.
</td></tr></tbody>
</table>4. Click **Submit**.
For more information on the Policy Exception Integration and the hand-off between the remediation owner and the compliance manager, see [Policy and Compliance optional setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/policy-compliance-optional-steps.md).
This file has no frontmatter.