Will Not Fix is a recorded decision to accept a known issue and take no corrective action. In security and identity programs, it signals that the risk, cost, or operational impact of remediation outweighs the benefit, so the finding remains open by policy, with ownership, justification, and review controls documented.
What a Will Not Fix decision means in practice
A Will Not Fix decision is a conscious exception, not a technical non-event. It records that the issue has been seen, owned, and accepted, so the organisation is explicitly choosing governance over remediation for that finding.
This makes the term operationally important because it separates unresolved-but-acknowledged risk from forgotten backlog. A well-run decision should preserve context: why the exception exists, who approved it, and when it must be revisited.
Where Will Not Fix is used in security programs
Teams usually use Will Not Fix when a defect, exposure, or control gap is real but remediation would create greater business disruption than the issue justifies. That can happen when the affected asset is near end of life, when a compensating control is stronger than the proposed fix, or when the cost of change outweighs the remaining exposure.
In security and identity programs, this label should be treated as a formal risk-acceptance outcome, not a convenience status. It is most defensible when the decision is deliberate, time-bound, and supported by an accountable owner rather than by simple inaction.
How Will Not Fix affects governance and accountability
The main governance effect is that the finding remains open while the organisation accepts the risk. That means exception management, review cadence, and ownership become part of the control story, because the issue is still present even though it will not be remediated.
Will Not Fix also creates an audit trail. If the rationale is incomplete, the decision can look indistinguishable from neglect, which weakens trust in vulnerability management, IAM reviews, and control exception reporting.
For a useful parallel on control discipline, see NIST SP 800-53 Rev 5 Security and Privacy Controls, which provides a control catalog for documenting, enforcing, and reviewing security obligations.
What good recordkeeping around Will Not Fix should capture
A strong Will Not Fix record explains the business reason, the scope of the accepted exposure, the compensating controls in place, and the review date. It should also show whether the issue is isolated or recurring, because repeat findings often point to a broader control weakness rather than a one-off exception.
That matters because an exception with no expiry or review can quietly become permanent policy by accident. The decision should remain visible enough that later teams can tell whether the original assumptions are still valid.
For broader security governance context, NIST Cybersecurity Framework 2.0 is useful for understanding how organisations structure govern, identify, protect, detect, respond, and recover activities around accepted risk.
Why the term matters for remediation and exception workflows
Will Not Fix is valuable because it forces an explicit choice between remediation and acceptance. Used correctly, it keeps teams honest about trade-offs and prevents the backlog from filling with unresolved items that no one is actually managing.
Used badly, it becomes a disposal bin for uncomfortable findings. The practical difference is whether the exception remains reviewable, owned, and defensible over time, or whether it simply hides unresolved exposure inside a status field.
For teams dealing with identity or access findings, the same discipline should be applied to how exceptions are recorded and revisited; a useful reference point is NIST 800-63 Digital Identity Guidelines, which helps frame assurance and identity risk decisions.
Risk and Threat Considerations
A Will Not Fix decision can leave a live weakness in place indefinitely, especially when the issue affects authentication, access control, secrets handling, or other security-sensitive workflows. The risk is not the label itself, but the possibility that a known exposure becomes normalised and stops receiving scrutiny.
Failure mechanism: An accepted issue can outlive the assumptions that justified it, while attackers or internal misuse benefit from the unchanged weakness, stale exception, or missed review.
Impact: The organisation may carry unresolved exposure across systems, audits, and incident response, and a once-defensible exception can turn into a persistent control failure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | Will Not Fix decisions often arise from vulnerability findings that remain open and must be tracked. |
| CA-5 — Plan of Action and Milestones | Accepted findings should remain owned, justified, and revisited through an exception or remediation register. | |
| SI-2 — Flaw Remediation | The term directly concerns decisions about whether a known flaw will be corrected or formally accepted. | |
| Recommendation — Document accepted vulnerability exceptions and keep them under continuous review. Track accepted findings with owners, milestones, and review dates. Use formal flaw-remediation decisions to separate fixes from approved exceptions. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Will Not Fix is a risk-acceptance decision that should align with the organisation's risk strategy. |
| GV.RM-03 — Risk Response Strategy | The decision sets a deliberate response of acceptance rather than remediation. | |
| Recommendation — Align accepted findings with the organisation's risk appetite and review cycle. Record whether the organisation is accepting, mitigating, transferring, or avoiding the risk. | ||
Practitioner Guidance
Why practitioners should care: Treat Will Not Fix as a formal governance decision, not a cleanup status. If the record does not clearly show ownership, rationale, and review timing, the organisation cannot later distinguish accepted risk from abandoned remediation.
What to watch for: The most common failure mode is exception drift, where the original justification is never revalidated after the environment, threat landscape, or business priority changes. That is when a temporary acceptance silently becomes permanent exposure.
Practitioner takeaway: If you cannot explain why the issue was accepted and when it will be reconsidered, the decision is too weak to rely on.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org