How do we score an exception and set how long it lasts?

Start

An exception request needs a score and an end date

The score settles three things that would otherwise be argued case by case: who may approve, how long the exception may run, and how quickly the approver must decide. Two people scoring the same request should reach the same band, so the method matters more than the numbers.

• Then: Can this rule be excepted at all?

Decision

Can this rule be excepted at all?

Some requests are refused before scoring: a legal or regulatory duty, a contractual duty to a customer or regulator, the exception standard itself, an open-ended request, backdated approval, a blanket request that names no systems, and your own non-negotiable controls. If any applies, there is nothing to score.

• Yes: Does it name the rule not met, the reason and a dated end?
• No: Refuse it without scoring

Outcome

Refuse it without scoring

Record the refusal and its reason in your register, so refused requests stay visible. A legal or regulatory issue goes to your compliance or legal escalation route. Otherwise the requirement applies in full.

Decision

Does it name the rule not met, the reason and a dated end?

A request is returned if it does not say which rule is not met and exactly what is not done, why the business needs it and what a refusal would cost, or an end date backed by a remediation plan. Other gaps do not stop scoring. They take the cautious default: unknown scope counts as the most important system, unknown reachability as internet-facing, and a control with no test evidence does not count. The approver's decision clock starts only when the request is complete.

• Yes: Information security scores it, at the worst system
• No: Return it to the requester

Outcome

Return it to the requester

Say exactly what is missing. The pack's examples of answers that send a request back: 'non-compliant with policy' in place of the actual gap, 'the business needs it' in place of what a refusal would cost, and no end date, or 'until the system is replaced' with no date. The decision time does not start until the request comes back complete.

Step

Information security scores it, at the worst system

The requester proposes ratings and controls. Information security sets the score and records the reason for each rating. Score the whole scope at its most important system, most sensitive data and most exposed point. Splitting one gap into several smaller requests to reach a more junior approver is a breach of the standard.

• Then: Rate impact from 1 to 4

Step

Rate impact from 1 to 4

Impact is the worst credible outcome if the gap were used while open. 1 Minor: one Standard system or non-sensitive data. 2 Moderate: a High-criticality system or internal confidential data. 3 Major: a Critical system, personal or customer data, or a regulated service. 4 Severe: could stop a core service, expose sensitive data at scale or breach a legal duty. Between two levels, take the higher. Controls never lower impact.

• Then: Rate likelihood from 1 to 4, without the proposed control

Step

Rate likelihood from 1 to 4, without the proposed control

Rate how likely the gap is to be used while open, with your ordinary protections but not the control put forward for this exception. 1 Unlikely: unreachable, no known exploitation. 2 Possible: reachable internally, needs skill or insider access. 3 Likely: reachable by many users or partners, techniques public. 4 Almost certain: internet-facing or actively exploited. Unknown reachability counts as internet-facing.

• Then: Is a compensating control in place and tested?

Decision

Is a compensating control in place and tested?

A control counts only if it addresses how the gap would be used and dated evidence shows it works now. A firewall rule that a scan shows is blocking access counts. A rule that 'should' block, a review that is only planned, or a reminder to staff does not. If you are not sure it has been tested, it has not.

• Yes: Lower likelihood by one step, once
• No, or not known: Which band does impact × likelihood give?

Step

Lower likelihood by one step, once

One step, however many controls there are, and never below 1. The pack keeps it to one step because controls fail and approvals outlive them. Its default is to refresh test evidence older than 30 days before the control counts.

• Then: Which band does impact × likelihood give?

Decision

Which band does impact × likelihood give?

Multiply the two ratings. Only nine scores are possible: 1, 2, 3, 4, 6, 8, 9, 12 and 16. For example, a Major gap on an internet-facing service with no tested control scores 3 × 4 = 12, Critical. The same gap with a tested sign-in restriction scores 3 × 3 = 9, High.

• Low (1–3): Low: control owner decides; up to 365 days
• Medium (4–6): Medium: Head of Information Security decides; up to 180 days
• High (8–9): High: security head and accountable executive; up to 90 days
• Critical (12–16): Critical: the top governing body decides; up to 30 days

Step

Low: control owner decides; up to 365 days

In the pack's defaults the control owner decides within 5 working days of a complete request. The exception may run up to 365 days, with two renewals by the same approver. Not every exception needs senior time.

• Then: Is the approver the requester, or the operator of the control?

Step

Medium: Head of Information Security decides; up to 180 days

In the pack's defaults the Head of Information Security decides within 10 working days of a complete request. The exception may run up to 180 days, with two renewals by the same approver.

• Then: Is the approver the requester, or the operator of the control?

Step

High: security head and accountable executive; up to 90 days

Both sign: the Head of Information Security, and the accountable executive for the service as risk owner. In the pack's defaults they decide within 10 working days of a complete request. The exception may run up to 90 days, with one renewal.

• Then: Is the approver the requester, or the operator of the control?

Step

Critical: the top governing body decides; up to 30 days

The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. The risk owner presents it. In the pack's defaults the decision comes within 5 working days, faster than High on purpose. The exception may run up to 30 days, with one renewal.

• Then: Is the approver the requester, or the operator of the control?

Decision

Is the approver the requester, or the operator of the control?

Nobody may approve their own exception, or one to a control they operate themselves. In a small organisation this happens often, because one person may request, own the requirement and run security.

• Yes: Send it to the next approval level up
• No: Set expiry at the plan's date or the band's cap, if sooner

Step

Send it to the next approval level up

The approval passes one level higher: a Low exception to the Medium approver, for example. Some organisations instead name in their standard who signs when the usual approver is conflicted. Record in your register who actually signed, so the decision can be checked against the band later.

• Then: Set expiry at the plan's date or the band's cap, if sooner

Step

Set expiry at the plan's date or the band's cap, if sooner

The expiry is the requested end date or the approval date plus the band's longest duration, whichever is earlier. Durations count in calendar days from approval, never from the date the gap began. They are ceilings: an exception covering a short project should end with the project. The owner is reminded 30 days before expiry.

• Then: At the monthly review, have the facts changed?

Decision

At the monthly review, have the facts changed?

Score it again when the scope grows, the weakness is reported as exploited, or a control changes. A higher score takes effect at once, and the expiry moves forward if the new band allows less time. A lower score waits for the next renewal. If a control you relied on stops working, re-score without it straight away.

• Yes: score it again: Rate impact from 1 to 4 (back to an earlier step)
• No: Scored and dated: record it in your register

Outcome

Scored and dated: record it in your register

Your register should show impact, likelihood before and after the control, the score, band, approver, approval date and expiry date. With those, an auditor can re-derive the band from the matrix and check the expiry falls within the band's limit. A renewal at expiry is scored again as a new request.