It would be helpful if we could have an “Accept Risk” option available for all security controls.

Currently, for one of our customers, there are some controls that are marked as non-compliant, these controls are not required for their environment. However, there is no option to mark these controls as “Accept Risk”.

This could make it difficult to identify new controls that may become relevant in the future. Without an “Accept Risk” option, we would need to review all of these controls again to determine whether any new controls require implementation.

Having the ability to mark non-required controls as “Accept Risk” would make it much easier to distinguish between controls that are intentionally not required and controls that genuinely need attention.