A security team identifies a vulnerability in an application that the developers will not be...

The vulnerability should be documented in the risk register because it represents an identified risk that cannot be immediately remediated. A risk register tracks risk details such as description, owner, likelihood, impact, severity, mitigation strategy, acceptance status, review dates, and residual risk. Since the developers cannot patch the issue for six months, the organization needs formal visibility and accountability until remediation is possible. A patching schedule may track when updates are planned, but it does not fully document risk ownership and business impact. A vulnerability matrix may help prioritize technical findings, but it is not the central governance record. Change management procedures control changes, not long-term risk tracking.