Exception Reporting (CFG-006-R008) - CFG-006

Requirement Details & Guidance

CFG-006-R008 · CFG-006

Why This Requirement Exists

Controlled configuration changes prevent unauthorized or unsafe modifications.

Implementation Guidance

Require authorized requests, impact assessment, testing, approval, implementation records, and post-change validation.

Practical Application & Audit Readiness

CFG-006-R008 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

CFG-006 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.3 – Build, Acquire and Implement (BAI) > BAI10 – Managed Configuration > BAI10.04 – Produce status and configuration reports.	COBIT Governance Framework	v2019	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1) – Security of processing; Article 32(1)(d) – Testing, assessing and evaluating security measures	EU Regulation	vCurrent	View →
HIPAA	Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(5) Standard: Risk management	US Law	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.9-3.3 – Change life cycle	India Guideline	vLatest	View →
ISO22301	ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 6.1.2 – Addressing risks and opportunities; 8.1 – Operational planning and control	ISO Standard	v2019	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.4 – Communication	ISO Standard	v2022	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.RA – Risk Assessment \| ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT, 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; RA-7 – RISK RESPONSE, CA-6 – AUTHORIZATION	NIST Control Catalog	vRev. 5	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Policy, Roles and Risk Linkages – Monitor policy compliance and exceptions	India Standard	vLatest	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.3.2 – A targeted risk analysis is performed for each	PCI Standard	v4	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 2) Preventing execution of unauthorised software – 2.4 Defined exception framework, approval and periodic review	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. CC2.2 – Information and Communication – COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Secure Configuration Management (CFG)

Purpose:

To enforce secure configurations for all systems and applications.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Configuration Exception Management (CFG-006)

Summary:

Establishes configuration exception management including request, risk assessment, approval, documentation, monitoring, renewal, periodic review, and closure for configuration deviations.

Business Description:

Establish and maintain processes to evaluate, approve, monitor, review, and retire approved deviations from secure configuration baselines.

View