Lesson 2.77: Security exceptions and risk acceptance
No organisation applies every control everywhere. A vendor appliance can't do MFA, an ERP can only be patched quarterly, old hardware can't encrypt. The honest answer is a security exception: a written, approved, time-limited agreement that a control doesn't apply to one system, with compensating controls and a named risk owner. ISO/IEC 27001 requires risk owners to approve the residual risk (clause 6.1.3). Exceptions without expiry dates become permanent holes. In the lab you review Northwind's exception register: expired, unapproved and over-long exceptions, those without compensation, and a renewal.
15 min
You will learn to
- Explain what a security exception is
- Find expired and soon-expiring exceptions
- Check approvals and compensating controls
- Enforce a maximum exception length
- Renew an exception with conditions
Key terms
- Security exception
- An approved, time-limited agreement that a control does not apply to a specific system or case.
- Compensating control
- An alternative measure that reduces the risk when the required control can't be applied.
- Risk acceptance
- A documented decision by the risk owner to live with a residual risk.
- Expiry date
- When the exception ends and must be closed or renewed.
- Exception register
- The list of all approved exceptions with owner, reason, compensation and expiry.
← The Cyber Kill Chain: an attack step by step · All lessons · Getting ready for a SOC 2 audit →