---
title: Approve the operational vulnerability
description: Approve the Operational vulnerability record after verifying its details such as the root cause analysis, treatment plan, timelines, and so on.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/approve-vul.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Managing Operational vulnerability, Manage, Operational Resilience, Governance, Risk, and Compliance]
---

# Approve the operational vulnerability

Approve the Operational vulnerability record after verifying its details such as the root cause analysis, treatment plan, timelines, and so on.

## Before you begin

Role required: sn\_oper\_res.manager, sn\_oper\_res.admin, approver of the vulnerability

## Procedure

1.  Navigate to **Workspaces** > **Operational Resilience Workspace** > **All Operational Vulnerabilities**.

2.  Navigate to the operational vulnerability record from the list or select **Vulnerability approvals** in **My pending tasks**.

3.  Select the record for which you have been assigned as the approver.

4.  Review the details of the operational vulnerability record.

5.  To approve the operational vulnerability record, select **Update state** UI action.

    The state of the operational vulnerability is updated from **Requested** to **Approved**. The state transition in the Approvers related list is shown in the example.

    \[Omitted image "update-vul-to-approved.png"\] Alt text: Update the state.

    The state of the operational vulnerability record is updated to **Approved**. The fields on the vulnerability record are now locked.

    Even though the Operational vulnerability record is in the **Approved** state, users can still perform an assessment or further investigation on the approved vulnerability by selecting one of the following states:

    -   **Assessment**
    -   **Treatment**
6.  To close the vulnerability, select **Update state** UI action and select **Closed**.

    The vulnerability record is in the **Closed** state. The fields on the vulnerability record are locked.


## What to do next

The Operational vulnerability analyst reviews the details and closes the Operational vulnerability record.