2.9 KiB
2.9 KiB
Title: Exception Management Procedure Document ID: [PROC-EXCEPTION-001] Version: 0.1 Draft Status: Draft Owner: CISO (Paul Jenkins) Approver: CISO (Paul Jenkins) Classification: Internal Effective date: [DD Month YYYY] Review date: [DD Month YYYY]
Exception Management Procedure
Purpose
This procedure defines how BlackDice should request, assess, approve, record, review, and close exceptions to required security controls.
Scope
This procedure applies to proposed deviations from approved policies, standards, procedures, or mandatory security requirements within the ISMS scope.
Trigger / When Used
Use this procedure when:
- a control requirement cannot be met
- a temporary deviation is needed for operational or technical reasons
- a compensating control is proposed in place of the standard requirement
Procedure Steps
- Submit an exception request describing the requirement affected, rationale, affected assets or services, duration, and proposed compensating controls.
- Confirm the request is complete and identify the relevant owner, approver, and impacted stakeholders.
- Assess the security, operational, customer, compliance, and resilience risk associated with the exception.
- Determine whether the exception can be accepted, requires additional controls, or should be rejected.
- Record the decision, approval, conditions, expiry date, and review date.
- Implement any required compensating controls or follow-up actions.
- Review open exceptions at defined intervals or when conditions change.
- Close the exception when the underlying issue is remediated or the exception expires without renewal.
Inputs
- exception request
- affected control requirement
- risk assessment information
- proposed compensating controls
Outputs / Records
- exception decision record
- approved conditions and expiry date
- linked risk or remediation actions
- closure record
Roles and Responsibilities
- Requesters must provide accurate justification and proposed mitigation.
- [Role] must coordinate exception review and record management.
- Approvers must evaluate risk and determine whether the exception is acceptable.
- Control owners must implement agreed compensating controls.
Escalation / Exceptions
Escalate where:
- the exception affects production, customer, or regulated data handling
- no compensating control is available
- the exception becomes long-term or repeatedly renewed
- disagreement exists over residual risk
This procedure governs exceptions; no additional procedural exception is needed beyond documented emergency handling.
Related Documents
- Information Security Policy
- Risk Assessment and Treatment Methodology
- Risk Assessment Procedure
- Security Exceptions Register Template
Version Control
| Version | Date | Description of Change | Author |
|---|---|---|---|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |