Description
When a version younger than the release-age threshold is needed (typically an urgent security fix), the exception names the package and exact version, the reason, the approver, and expires after at most {{ max_exception_days }} days.
Rationale
Without a clear process, teams disable the rule globally the first time they are blocked, and never turn it back on.
Impact
Someone must be available to approve exceptions quickly.
Parameters
| Parameter | Baseline | Hardened | Bounds | Description |
|---|---|---|---|---|
max_exception_daysinteger | 7 days | 7 days | 1 to 30 | Maximum lifetime of a release-age exception. |
The value used is your override, else the profile's, else the default. Bounds limit what an override may set.
Audit
- List active release-age exceptions.
- Check each one targets an exact version, has a recorded reason and approver, and is younger than {{ max_exception_days }} days.
- Check the global rule is not disabled.
Automated: every check must pass. Scanners report each check by its id.
postmortem
every [[gate.allow]] / AGE waiver has an expiry within the limit; approval is by hand
command: postmortem harden --json
control: CB-DEP-AGE-003
coverage: partial
Remediation
- Define who can approve exceptions and where they are recorded.
- Remove expired and global exceptions.
References
- Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | CM-3 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- related
CB-DEP-AGE-001Wait a minimum age before installing a new package version
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |