It security exception process

An exception may be granted by the Chief Information Security Officer (CISO) of [entity], or their designee, for non-compliance with a policy or standard resulting from: Implementation of a solution with equivalent protection to the requirements in the policy or standard.

An exception to a published IT/information security policy, standard or practice may be granted in any of the following situations: Temporary exception, where immediate compliance would disrupt critical operations. Another acceptable solution with equivalent protection is available. A superior solution is available.

If a superior solution is available, an exception will be granted until the solution can be reviewed, and standards or procedures can be updated to allow for a better solution. The exception process is intended to be a generic method that applies to all IT/information security policies and standards.