Policy Exception
What is Policy Exception?
A formal approval to deviate from an established policy or standard requirement. Policy exceptions must be documented, time-bound, approved by appropriate authority, and include compensating controls.
Frameworks that govern policy exception
What the standards actually require on policy exception
Requirements naming policy exception across 4 standards, quoted from the control text.
Handle any deviation from an established policy through an approved exception process defined by the governance programme.
CCM-GRC-04 · Policy Exception Process →Whenever an established policy is departed from, an approved exception process required by the governance programme is set up and followed.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::GRC-04 · Policy Exception Process →Implement a managed interface for each external telecommunications service with a traffic flow policy, protect the confidentiality and integrity of what crosses it, document each policy exception with its mission need and duration, review exceptions annually,...
fbi-cjis-security-policy::SC-7(4) · SC-7(4) Boundary Protection | External Telecommunications Services →Management sets and monitors objective standards to measure risk in development, acquisition and maintenance on an ongoing basis commensurate with size and complexity, using automated tools as complexity grows, with measures such as estimated against actual co...
ffiec-it-examination-handbook::DAM-III.B · III.B Risk Measurement (Development, Acquisition, and Maintenance) →Questions people ask about policy exception
What is Policy Exception?
Why is Policy Exception important for compliance?
Which compliance frameworks address Policy Exception?
Where can I learn more about Policy Exception?
See how Policy Exception applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.