I would love to have a way to mark vulnerabilities or groups of vulnerabilities as "accepted" instead of Suppressed. With this, it would be helpful to have an Accepted Risks area in which we can see them all and sort them. Plus, it would be helpful to have a risk acceptance documentation method.

I imagine a pathway in which we could send a vulnerability detail set or group of vulns with details to a client wrapped in a templated risk acceptance document that they would then need to acknowledge / sign. Doing this with more than 1 risk on the doc would be great for handling multiple things at once and having the client sign only 1 document instead of one for each risk - too much for the client.

Once signed and marked as accepted, the vuln should still show up in the portal but not count against the metrics (or have separate metrics for them) or SLAs. Perhaps a reminder could be set for X number of days on any given Accepted Risk or group of risks (tags?) - that would let us or the client know that it still remains and should be addressed.

Additionally, perhaps there could be a status for these as "Compensated" - so that the risk exists but is documented as having a compensating control. Documentation on this would be helpful too.