Record the condition and consequence
An exception should name the requirement that cannot be met, the affected systems, the reason, the plausible consequence and the period requested. “Business need” is not enough. Reviewers need to understand what outcome is weakened and which dependency prevents the normal control.
Separate temporary inability from risk acceptance. A team may need time to replace an application, but an accountable decision-maker still chooses whether the exposure is tolerable during that period. State assumptions and evidence so the decision can be revisited when conditions change.
Constrain and monitor the exception
Identify compensating safeguards that reduce the same attack path rather than unrelated controls that simply look reassuring. Restrict users, networks, actions or time where possible. Add monitoring that can detect misuse or control failure and assign someone to review the signal.
Every exception needs an owner, approver, creation date, expiry and remediation plan. High-consequence exceptions require shorter review cycles. Prevent automatic renewal; repeated extensions should expose the underlying funding, architecture or supplier decision to leadership.
Close with verification
When remediation is reported complete, verify the control on the intended population and remove temporary safeguards that are no longer required. Preserve the decision history because it explains why unusual configuration or monitoring existed.
Report exception concentration, age, overdue reviews and recurring causes. Do not use a single count as a risk score. The useful question is whether exceptions cluster around critical services, shared platforms or unresolved modernisation work that deserves a coordinated programme.
What to do next.
- ✓State the unmet requirement and consequence.
- ✓Identify the affected systems and population.
- ✓Select compensating controls for the same attack path.
- ✓Assign owner, approver, expiry and remediation plan.
- ✓Prevent automatic renewal.
- ✓Verify remediation before closure.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.