Does your organization maintain documentation of risk assessments and mitigation plans for all security policy exceptions?

Managing policy exceptions is the concern: the question is whether you document risk assessments and mitigation plans for every exception granted to your security policies. For example, if an exception is requested to allow a legacy system to operate without current patches, the documentation should identify potential vulnerabilities and specify compensating controls like network segmentation or enhanced monitoring.

Evidence could include a formal exception management document that contains risk assessments for each exception, identified risk levels, mitigation strategies, implementation timelines, and approval signatures from appropriate stakeholders. This document should demonstrate that exceptions are not granted without thorough risk analysis and mitigation planning.