Does your organization maintain documentation of risk assessments and mitigation plans for all security policy exceptions?

This question assesses whether your organization formally evaluates and documents the risks associated with any exceptions to security policies, along with specific plans to address those risks. For example, if an exception is requested to allow a legacy system to operate without current patches, the documentation should identify potential vulnerabilities and specify compensating controls like network segmentation or enhanced monitoring. Evidence could include a formal exception management document that contains risk assessments for each exception, identified risk levels, mitigation strategies, implementation timelines, and approval signatures from appropriate stakeholders. This document should demonstrate that exceptions are not granted without thorough risk analysis and mitigation planning.