Active

Exception Request

The organization shall submit exception requests for deviations from organizational policies, standards, and control requirements. Requests shall include a description of the deviation, the reason for the exception, proposed compensating controls, the requested exception period, and the business justification, submitted in a consistent format with all required information provided.

Requirement ID
EXC-002-R001
Parent Control
EXC-002
Domain Code
EXC

Requirement Details & Guidance

EXC-002-R001 · EXC-002
Why This Requirement Exists

To ensure every policy or control deviation is formally documented with enough information to evaluate business need, risk, duration, and proposed safeguards.

Implementation Guidance

Use a standardized request form requiring the affected policy/control, business justification, scope, systems or data affected, requested duration, risk information, proposed compensating controls, and accountable owner; reject incomplete submissions.

Practical Application & Audit Readiness

EXC-002-R001 · Field Guidance

Business Examples

    Common Audit Findings

      Common Mistakes

        Best Practices & Ownership

        EXC-002 · Recommended Approach

        Recommended Practices

          Typical Owner

          Cross-Mapped Regulatory Frameworks

          Harmonized Control Mappings
          FRAMEWORK CODE FRAMEWORK NAME & DETAILS FAMILY / CATEGORY VERSION ACTION
          RBI-CSF RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 2) Preventing execution of unauthorised software – 2.4 Defined exception framework, approval and periodic review; Circular §5 – Identification/assessment of inherent cyber risks and controls
          India
          Regulation
          		 vLatest View →
          PCI-DSS PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.3.2 – A targeted risk analysis is performed for each
          PCI
          Standard
          		 v4 View →
          COBIT2019 COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO12 – Managed Risk > APO12.06 – Respond to risk.
          COBIT
          Governance Framework
          		 v2019 View →
          NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
          NIST
          Framework
          		 v2 View →
          NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT, 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; RA-7 – RISK RESPONSE, CA-6 – AUTHORIZATION
          NIST
          Control Catalog
          		 vRev. 5 View →
          SOC2 SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.
          AICPA
          Audit Framework
          		 vLatest View →

          Parent Domain Context

          Governance Domain Baseline
          Domain Name:
          Exception Management (EXC)
          Purpose:
          To manage deviations from established policies and standards through a formal risk-based process.
          Scope:
          Enterprise
          View

          Parent Control Context

          Control Baseline
          Control Name:
          Exception Lifecycle Management (EXC-002)
          Summary:
          Establishes exception lifecycle including request, risk assessment, approval, documentation, monitoring, periodic review, renewal, expiration, closure, and continuous improvement for security and compliance exceptions.
          Business Description:
          Establish and maintain processes to request, assess, approve, document, monitor, periodically review, renew, expire, and close security and compliance exceptions throughout their lifecycle.
          View