---
title: Request a bulk exception using GRC: Policy and Compliance Management
description: Select a group of vulnerable items and submit a bulk exception.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/bulk-edit-grc.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Request an exception using GRC: Policy and Compliance Management, Requesting and approving an exception, Vulnerability Response remediation overview, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Request a bulk exception using GRC: Policy and Compliance Management

Select a group of vulnerable items and submit a bulk exception.

## Before you begin

Before you can use the Policy Exception Integration to request bulk exceptions, you must download the GRC: Policy and Compliance Management application from the ServiceNow Store.

**Note:** To use this feature, you must upgrade GRC: Policy and Compliance Management before upgrading Vulnerability Response. If you have already upgraded Vulnerability Response before GRC: Policy and Compliance Management, and want to use this feature, you must perform the upgrade procedures again in the correct order.

Persona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).

Role required: sn\_vul.remediation\_owner

You can also request exceptions in the classic environment in Vulnerability Response.

## Procedure

1.  Navigate to **All** > **Vulnerability Response** > **Vulnerable Items** > **All** and select the items that you want to request an exception for.

    The selected items must be in Open, Under investigation, or Awaiting implementation state.

2.  Click **Bulk Edit**.

3.  On the form, fill in the fields.

    |Field|Description|
    |-----|-----------|
    |Record selection|Records that you selected for a bulk edit.|
    |State|State of the vulnerable item. Select the Deferred state to request an exception for the selected items.|
    |Short description|Name of the task that you are creating.|
    |Preferred solution|Solution that you are targeting for remediating all the vulnerable items that you selected for bulk edit.|
    |Assignment group|Assignment group for the VI. You can select a group manually or use Assignment Recommendations if that feature is enabled.|
    |Work notes|Notes to be added.|

4.  Click **OK**.

    A remediation task is created with the selected vulnerable items.

5.  On the form, fill in the fields.

<table id="table_stm_xty_flb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Policy

</td><td>

Vulnerability Management policy that you are requesting an exception for.

</td></tr><tr><td>

Control objective

</td><td>

Control objectives that are associated with the policy that you selected. If a policy is not selected, all the control objectives are listed.

</td></tr><tr><td>

Valid from

</td><td>

Date when the exception will start. The default value is the current date. This date cannot be in the past.

</td></tr><tr><td>

Valid until

</td><td>

Date that the policy exception expires and the state of the vulnerable item or group changes from Deferred to Open.**Note:** The number of days that the policy exception is valid cannot exceed the **Maximum exception duration \(days\)** that you set for the policy in GRC: Policy and Compliance Management. For more information, see [Create a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/governance-risk-compliance/t_DefineAPolicy.md).

</td></tr><tr><td>

Reason

</td><td>

Reason for requesting an exception.

</td></tr><tr><td>

Justification

</td><td>

Details that are related to the reason why this request is being made. This mandatory field must be filled in by the remediation owner.

</td></tr></tbody>
</table>6.  Click **Submit**.

    For more information on the Policy Exception Integration and the hand-off between the remediation owner and the compliance manager, see [Policy and Compliance Management optional setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/governance-risk-compliance/policy-compliance-optional-steps.md).