Write who accepted the residual risk, and when it expires.

Question: patch now, isolate, compensate, or accept until a named window. Owner: often a CISO or service owner. Stakeholders: risk, legal, and the operational lead who will live with the exposure.

Adopting a Verdict does not automatically accept the risk. The Human Decision has to say accept, and against which Verdict version.

Residual risk in plain language, the compensating control if any, blast radius, and the date the acceptance expires. Evidence required: reachability, not a scanner label. Known unknowns: untested compensating controls and windows that exist only on a slide.

Material risks include change-induced outage and an acceptance that nobody reviews.

Decision Hinges: whether the exposure is reachable, whether the freeze is real, and whether isolate is cheaper than accept. Required approvals: Decision Owner and the person who can accept residual risk for the organization.

What could reverse the Verdict: a public exploit, a failed compensating control, or a window that moved. Outcome review: on the expiry date, not when someone remembers.

Champion can defend the preferred control. Challenger attacks residual risk and change-induced outage. Red Teamer tries to break the plan. Inspector will not treat a scanner label as reachability. Judge can leave accept on the table.

The Decision record holds the question, the options, the evidence, and the Verdict.

Champion and Challenger test the case, Inspector checks the evidence, and Judge records the Verdict for the Decision Owner.

Patch this week during a freeze, isolate the service, compensate, or accept until the next window. If the organization accepts, the record should say who accepted, against which Verdict version, and when that acceptance expires.