Establishes the processes for managing exceptions to security policies, standards, and control requirements in a controlled and governed manner.
Governs the lifecycle of exceptions, allowing for necessary business agility while ensuring risk is assessed and managed through documented approvals.
Organizations either have no exception process, leading to shadow exceptions, or have cumbersome processes that take too long and frustrate business teams.
| Control ID | Control Name | Category & Type | Criticality | Status | Requirements | Action |
|---|---|---|---|---|---|---|
| EXC-001 | Exception Management Program Establishes exception management program... |
Administrative
Corrective
|
Critical | Active | 📋 10 Reqs | View → |
| EXC-002 | Exception Lifecycle Management Establishes exception lifecycle includin... |
Administrative
Corrective
|
High | Active | 📋 10 Reqs | View → |
The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.
| REQUIREMENT ID | REQUIREMENT TITLE & DETAILS | MAPPED CONTROL | TYPICAL OWNER | ACTION |
|---|---|---|---|---|
| EXC-001-R001 | Exception Governance Framework The organization shall establish an exce... | EXC-001 Exception Management Program | Risk & Compliance, CISO, Exception Management Committee | View ↗ |
| EXC-001-R002 | Program Scope The organization shall define a document... | EXC-001 Exception Management Program | Exception Manager, CISO, Compliance, Control Owners | View ↗ |
| EXC-001-R003 | Roles & Responsibilities The organization shall clearly define an... | EXC-001 Exception Management Program | Exception Manager, Control Owners, Risk Management, CISO | View ↗ |
| EXC-001-R004 | Exception Policy The organization shall establish an exce... | EXC-001 Exception Management Program | CISO, Compliance, Risk Management, Policy Owner | View ↗ |
| EXC-001-R005 | Risk Governance The organization shall establish governa... | EXC-001 Exception Management Program | Chief Risk Officer, CISO, Risk Management, Exception Approvers | View ↗ |
| EXC-001-R006 | Exception Metrics The organization shall define and track... | EXC-001 Exception Management Program | Exception Manager, Risk Management, CISO | View ↗ |
| EXC-001-R007 | Executive Reporting The organization shall provide executive... | EXC-001 Exception Management Program | CISO, Chief Risk Officer, Board Risk Committee, Exception Manager | View ↗ |
| EXC-001-R008 | Program Review The organization shall conduct periodic... | EXC-001 Exception Management Program | Exception Manager, CISO, Risk Management, Internal Audit | View ↗ |
| EXC-001-R009 | Program Compliance The organization shall ensure the except... | EXC-001 Exception Management Program | Compliance Officer, CISO, Legal, Exception Manager | View ↗ |
| EXC-001-R010 | Continuous Improvement The organization shall establish a conti... | EXC-001 Exception Management Program | Exception Manager, CISO, Control Owners, Process Improvement Team | View ↗ |
| EXC-002-R001 | Exception Request The organization shall submit exception... | EXC-002 Exception Lifecycle Management | Control Owner, Exception Requestor, Exception Manager | View ↗ |
| EXC-002-R002 | Exception Risk Assessment The organization shall conduct risk asse... | EXC-002 Exception Lifecycle Management | Risk Management, Security Risk Officer, Control Owner | View ↗ |
| EXC-002-R003 | Exception Approval The organization shall approve exception... | EXC-002 Exception Lifecycle Management | Authorized Exception Approver, CISO, Risk Management, Control Owner | View ↗ |
| EXC-002-R004 | Exception Documentation The organization shall maintain comprehe... | EXC-002 Exception Lifecycle Management | Exception Manager, GRC Administrator, Records Management | View ↗ |
| EXC-002-R005 | Exception Monitoring The organization shall monitor approved... | EXC-002 Exception Lifecycle Management | Control Owner, Exception Manager, Security Operations | View ↗ |
| EXC-002-R006 | Exception Periodic Review The organization shall conduct periodic... | EXC-002 Exception Lifecycle Management | Exception Owner, Control Owner, Risk Management | View ↗ |
| EXC-002-R007 | Exception Renewal The organization shall renew exceptions... | EXC-002 Exception Lifecycle Management | Exception Manager, Exception Owner, Risk Approver | View ↗ |
| EXC-002-R008 | Exception Expiration The organization shall manage exception... | EXC-002 Exception Lifecycle Management | Exception Manager, Control Owner, IT Operations | View ↗ |
| EXC-002-R009 | Exception Closure The organization shall close exceptions... | EXC-002 Exception Lifecycle Management | Control Owner, Exception Manager, Security Assurance | View ↗ |
| EXC-002-R010 | Continuous Improvement The organization shall establish a conti... | EXC-002 Exception Lifecycle Management | Exception Manager, CISO, Control Owners, Process Improvement Team | View ↗ |
| Framework Code | Framework Name & Description | Family / Category | Version | Action |
|---|---|---|---|---|
| MAPPED | ISO 27001 (Clause 8.2) Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| NIST-CSF | NIST CSF (ID.GV-2) The NIST Cybersecurity Framework provide... |
NIST
Framework
|
v2 | View → |
| COBIT2019 | COBIT (APO13) COBIT is an enterprise governance and ma... |
COBIT
Governance Framework
|
v2019 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard... |
PCI
Standard
|
v4 | View → |
| GDPR | GDPR (Article 32) The General Data Protection Regulation i... |
EU
Regulation
|
vCurrent | View → |
| NIST80053 | NIST SP 800-53 (CA-5) NIST SP 800-53 Rev. 5 presents control f... |
NIST
Control Catalog
|
vRev. 5 | View → |