Skip to content

Exception Management

What is Exception Management?

The formal process of documenting, approving, and tracking instances where an organisation cannot comply with a specific policy or control requirement. Exceptions require documented business justification, compensating controls, and periodic review.

Compliance

Frameworks that govern exception management

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →

What the standards actually require on exception management

Requirements naming exception management across 4 standards, quoted from the control text.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.11 control

Handle exceptions and emergency changes through a defined procedure aligned with the organisation's policy exception process.

CCM-CCC-08 · Exception Management →
ISO/IEC 29134:20231 control

Track implementation of PIA action plan with status reporting and exception management.

ISO29134-10.1 · PIA Implementation Tracking →
OWASP DevSecOps Maturity Model (DSOMM)1 control

Per OWASP DevSecOps Maturity Model (DSOMM) Culture and Organization dimension: establish organisational structures + governance + education + collaboration + that embed security into DevOps culture.

DSOMM-1 · Culture, Organization, Education, and Governance →
OpenSSF Scorecard1 control

Implement branch protection + code review + repository governance per OpenSSF Scorecard checks Branch-Protection + Code-Review + Maintained.

OSSFSC-1 · Branch Protection, Code Review, and Repository Governance →

Questions people ask about exception management

What is Exception Management?
The formal process of documenting, approving, and tracking instances where an organisation cannot comply with a specific policy or control requirement. Exceptions require documented business justification, compensating controls, and periodic review.
Why is Exception Management important for compliance?
Exception Management is a key concept in Compliance. Understanding exception management helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Exception Management?
Exception Management appears in the requirement text of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO/IEC 29134:2023, OWASP DevSecOps Maturity Model (DSOMM), OpenSSF Scorecard. Across these standards we have identified 4 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Exception Management?
Explore our compliance framework pages to see how exception management applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Exception Management applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.