Vulnerability Management/Exception Management

Quick question. I have recently started working more with vulnerability management and today I had someone ask me to remove an exception that wasnt set to expire for another 5 months and add it back, just so we can extend the duration.

This seems like someone trying to pad vuln metrics? Every “regulatory” bone in my body is telling me to tell the person to come back when the vulnerability was originally approved to expire. There is no approval or …

back body cybersecurity management metrics my body question regulatory remove today vuln vulnerability vulnerability management working