Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we stop the exception register becoming a graveyard?

7 decision pointsThe pack behind this answer: Security Exception, Waiver & Segregation of Duties

Add to board memo

The short answer

Recommendation
Give every exception a fixed expiry no later than its band allows, review the whole register monthly, and remind owners 30 days before expiry. Close exceptions only on dated evidence, and send any that outlive their renewals or the grace period after expiry to the next approval level up.
Reasoning
Registers fail the same way: an expiry passes, someone extends it by email, and a temporary exception becomes permanent. A fixed monthly routine forces each exception to be closed, renewed or taken higher. Renewal is due before expiry. The 10 working days after it are a grace period for a late renewal, which is reported, and the exception is not valid during them. A renewal limit turns a chronic gap into a management decision: fund the fix or, if the gap is to stay, change the rule first and accept any remaining risk in the risk register.
Considerations
  • The durations, reminder periods, grace period, renewal limits and targets are the defaults in the CISO Times exceptions pack. Your own standard may set different ones.
  • If the register's keeper also raises exceptions, have someone else do the monthly review and keep changes in the file's version history, so the keeper cannot extend or close their own exceptions unseen.
  • Past its renewal limit, a High exception goes to the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. A Critical one goes to the full board, or its equivalent.
  • In the pack's defaults the targets are zero expired High or Critical exceptions, below 5% expired overall and zero chronic. Watch the trend over several months, not one.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartThe register holds exceptions nobody looks atStepGive every exception one ID and a fixed expiry dateStepReview the whole register every monthDecisionIs its expiry date later than its band allows?StepShorten it to the maximum allowed expiryDecisionHas its control, exposure or remediation plan changed?StepRe-score it, and send it higher if the band risesDecisionHas it passed its expiry date without closure or renewal?StepReport it as non-compliance and notify the ownersDecisionFixed or renewal requested within 10 working days?OutcomeEscalate to the next level up and name it every quarterDecisionDoes it expire within the next 30 days?OutcomeIn date and covered: carry the figures to the quarterly reportStepAsk the owners: close it, renew it or let it lapseDecisionIs there dated evidence that the gap has gone?OutcomeClose it with the evidence, and keep the rowDecisionIs another renewal within the band's limit?OutcomeRenew it as a new request with fresh evidenceOutcomeChronic: take it to the next level up for a decision

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 19 steps.

  1. Start

    The register holds exceptions nobody looks at

    Registers die the same way: an expiry date passes, someone extends it by email, and a temporary exception becomes permanent. The cure is a fixed monthly routine that forces every exception to be closed, renewed or taken higher.

    In the pack

  2. Step

    Give every exception one ID and a fixed expiry date

    Add a row as soon as a complete request arrives, and keep refused, closed and expired rows: they are the record. Keep the same ID and first start date through every renewal, so its true age stays visible. Set the expiry at approval, no later than the band's maximum. In the pack's defaults that is 365 days for Low, 180 for Medium, 90 for High and 30 for Critical.

    In the pack

  3. Step

    Review the whole register every month

    Freeze the as-at date and go through every open exception. Record who reviewed, what changed and what was escalated at the foot of the review. If the register's keeper also raises exceptions, the pack rates that a conflict: someone other than the keeper does the monthly review, and changes stay in the file's version history, so the keeper cannot extend or close their own exceptions unseen.

    In the pack

  4. Decision

    Is its expiry date later than its band allows?

    Compare the expiry date with the decision date plus the band's maximum duration. The register's monthly review lists any row where the expiry is later, and the pack's action is to shorten it.

    In the pack

  5. Step

    Shorten it to the maximum allowed expiry

    Bring the date back to the band's maximum and tell the requester and risk owner. The maximum is a ceiling, not a default: an exception covering a 90-day project should not run longer because the band allows it.

    In the pack

  6. Decision

    Has its control, exposure or remediation plan changed?

    Ask for current evidence that the compensating control still works, for every High and Critical exception and a sample of the others. Check the remediation plan against its milestones. Look for new exposure or active exploitation. If you cannot get current evidence, treat the answer as yes.

    In the pack

  7. Step

    Re-score it, and send it higher if the band rises

    A control that no longer works stops lowering the likelihood. If the new score moves the exception into a higher band, send it to that band's approver, and bring the expiry date forward if the new band's maximum is shorter. Record a missed milestone and discuss it with the requester and risk owner.

    In the pack

  8. Decision

    Has it passed its expiry date without closure or renewal?

    An expired exception is a control left off with nobody's current approval. The requirement applies again in full from the day after expiry.

    In the pack

  9. Step

    Report it as non-compliance and notify the owners

    On the first working day after expiry, mark it expired and tell the requester, risk owner and control owner. Tell the approver the same day for a High or Critical exception. Report it as non-compliance at the monthly review: it is no longer covered.

    In the pack

  10. Decision

    Fixed or renewal requested within 10 working days?

    The 10 working days after expiry are a grace period for a late renewal, not an extension. By then the owners must have fixed the gap or submitted a late renewal, which is reported in the monthly review and the next quarterly report. If you do not know, treat it as no.

    In the pack

  11. Outcome

    Escalate to the next level up and name it every quarter

    Send it to the next approval level up, and name it in each quarterly report until it is resolved. The escalation states the exception, the requirement, the band, the dates and the decision needed: fix, renew or accept at a higher level. It asks for a decision, not attention.

    In the pack

    See also

  12. Decision

    Does it expire within the next 30 days?

    The 30-day window is the one that turns into next month's expired count if nobody acts. An exception approved for 30 days or less gets its reminder on the day it is approved.

    In the pack

  13. Outcome

    In date and covered: carry the figures to the quarterly report

    Each quarter, report open exceptions by band, expired exceptions, chronic exceptions and unmitigated segregation of duties conflicts. List every High, Critical and chronic exception by name, with the decisions management needs to take. In the pack's defaults the targets are zero expired High or Critical, below 5% expired overall, and zero chronic. Watch the trend over several months, not one.

    In the pack

  14. Step

    Ask the owners: close it, renew it or let it lapse

    Send the reminder to the requester and risk owner, and ask which it will be. In the pack's defaults, if there is no reply within 10 working days, remind them again and copy the approver.

    In the pack

  15. Decision

    Is there dated evidence that the gap has gone?

    Evidence means a scan, configuration export or test result dated after the change for every system named, a retirement record with the updated inventory, or an approved change to the requirement. A ticket marked done or a remediation plan marked complete is not evidence on its own.

    In the pack

  16. Outcome

    Close it with the evidence, and keep the row

    Record the closure date and evidence reference, and tell the requester, risk owner, control owner and approver. Remove compensating controls only after closure, and only if nothing else needs them. Do not delete the row.

    In the pack

  17. Decision

    Is another renewal within the band's limit?

    In the pack's defaults, Low and Medium exceptions may be renewed twice by the same approver, High and Critical once. A renewal never restarts the count, and a change of band does not reset it.

    In the pack

  18. Outcome

    Renew it as a new request with fresh evidence

    Renew before expiry. The request gives the current state of the compensating control with fresh evidence, progress on the remediation plan, why it is late and the new date. It is scored as a new request. The new expiry counts from the renewal's approval and is no later than the band's maximum. A renewal made after expiry is late, and the gap stays reported as non-compliance until it is approved.

    In the pack

    See also

  19. Outcome

    Chronic: take it to the next level up for a decision

    It has stopped being temporary. A further renewal goes to the next approval level up. For a High exception that is the board or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. For a Critical one it is the full board or its equivalent. Management decides whether to fund the fix or, if the gap is to stay, to change the rule first and accept any remaining risk in the risk register. A permanent exception is a rule that no longer reflects policy. Name it in every quarterly report until it is closed.

    In the pack

    See also

Practical checklist

  1. Add a row for every complete request, keep one ID and first start date through every renewal, and keep refused, closed and expired rows.
  2. Set the expiry at approval, and shorten any expiry later than the band's maximum.
  3. Each month, ask for current control evidence for every High and Critical exception and a sample of the others, and re-score any whose facts changed.
  4. Remind the requester and risk owner 30 days before expiry and ask them to close, renew or let it lapse.
  5. On the first working day after expiry, mark it expired, report it as non-compliance and tell the owners, and the approver for High or Critical.
  6. Escalate any expired exception not fixed or renewed within 10 working days to the next approval level up.
  7. Close an exception only on dated evidence that the gap has gone, and send a renewal beyond the band's limit one level up.
  8. Report open, expired and chronic exceptions and unmitigated conflicts each quarter, naming every High, Critical and chronic one.

Evidence to have ready

  • The register, with each exception's band, decision date, expiry, renewal count, first start date and closure evidence.
  • Each monthly review record: who reviewed, the as-at date, scores changed, exceptions escalated and actions agreed.
  • Expiry notices, late renewals and escalations, with their dates.
  • The quarterly management reports, naming each High, Critical and chronic exception and the decisions sought.

Assumptions

  • You keep an exception register, in a spreadsheet or a tool, with an expiry date, a band and a renewal count for each exception.
  • The durations, reminder periods, grace period, renewal limits and targets shown are the defaults in the CISO Times exceptions pack. Your own standard may set different ones.

Not covered here