Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If an exception expires and the gap is still there, then what?

5 decision pointsThe pack behind this answer: Security Exception, Waiver & Segregation of Duties

Add to board memo

The short answer

Recommendation
Treat the gap as non-compliance from the day after expiry, tell the owners at once, and keep the compensating controls running. Within the 10 working days that follow, fix it with evidence, renew it late on a fresh score, or escalate it to the next approval level up.
Reasoning
The approval ended on the expiry date, so the requirement applies again in full. The grace period is time to resolve the gap. It does not extend the exception, which is not valid during it. Approval never runs backwards, so the days between expiry and any renewal stay on record as non-compliance. The gap and its risk remain after expiry, so the controls stay in place. Escalation asks a higher level for a decision: fix, renew, or accept at a higher level.
Considerations
  • The 10 working days and the other timings are the defaults in the CISO Times exception pack. Your own standard may set different ones.
  • For High, tell the Head of Information Security and the accountable executive on the first working day. For Critical, tell the board, its delegated risk committee, the management board or executive management, as your structure gives. Low and Medium approvers hear at the monthly review.
  • A late renewal still counts toward the band's renewal limit. One beyond the limit goes up a level, and the exception becomes chronic, named in every quarterly report until it is closed.
  • If the renewal is refused, the requirement must be met and the gap is reported as a breach.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartThe expiry date passed and the gap is still openStepMark it Expired and tell the owners the next working dayDecisionWas it a High or Critical exception?StepTell its approver the same dayStepReport it as non-compliance at the next monthly reviewStepKeep the compensating controls runningDecisionCan the gap be closed within 10 working days?StepFix it and send dated closure evidenceDecisionDoes the evidence show the requirement is met?OutcomeClosed in your register with the evidence referenceDecisionIs more time justified, with a tested control and a new date?StepSubmit a late renewal now, scored as a new requestDecisionIs the renewal within the band's renewal limit?OutcomeThe band's approver decides the renewalOutcomeIt goes a level up and becomes chronicOutcomeBy working day 10, escalate to the next level up

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 16 steps.

  1. Start

    The expiry date passed and the gap is still open

    Nobody closed the exception with evidence or renewed it in time, although the owners should have had a reminder 30 days before expiry. The approval ended on the expiry date, so the gap is now uncovered. The standard sets what happens next.

    In the pack

  2. Step

    Mark it Expired and tell the owners the next working day

    On the first working day after expiry, set its status to Expired in your register and tell the requester, risk owner and control owner. The requirement applies again in full. The grace period that follows is time to resolve the gap. It does not extend the exception.

    In the pack

  3. Decision

    Was it a High or Critical exception?

    The serious bands are reported upwards at once. The pack's target is zero expired High or Critical exceptions, and below 5% of all open exceptions expired.

    In the pack

  4. Step

    Tell its approver the same day

    Tell whoever approved it on the first working day after expiry. For High that is the Head of Information Security and the accountable executive. For Critical it is the board, its delegated risk committee, the management board or executive management, depending on how you are governed. The approver of a Low or Medium exception hears at the monthly review.

    In the pack

    See also

  5. Step

    Report it as non-compliance at the next monthly review

    The deviation is no longer covered by an exception, so it counts as non-compliance in the monthly review and in the expired-exceptions measure. Approval never runs backwards. If the exception is renewed later, the days between expiry and the new approval stay on record as non-compliance.

    In the pack

  6. Step

    Keep the compensating controls running

    Expiry ends the approval. The gap and its risk remain, so controls such as an access restriction or alerting stay in place. The pack allows compensating controls to be removed only after closure. If one has stopped working, the risk is higher than when the exception was approved.

    In the pack

  7. Decision

    Can the gap be closed within 10 working days?

    Closing means the requirement is met, the system is retired, or the requirement has been formally changed. Ask the requester and risk owner for a realistic date. If they cannot give one, treat the answer as no.

    In the pack

  8. Step

    Fix it and send dated closure evidence

    Evidence is a scan, configuration export or test result dated after the change, for every system named; a retirement record with the updated asset inventory; or the approved revision of the requirement. A ticket marked done, or a remediation plan marked complete, closes nothing on its own.

    In the pack

  9. Decision

    Does the evidence show the requirement is met?

    Information security checks it. If it falls short, the requester is told what is missing, and the exception stays open and expired while the grace period runs.

    In the pack

  10. Outcome

    Closed in your register with the evidence reference

    Record the closure date and the evidence reference, and tell the requester, risk owner, control owner and approver. The compensating controls can come out now, unless they are needed for another reason.

    In the pack

  11. Decision

    Is more time justified, with a tested control and a new date?

    A renewal needs fresh evidence that the compensating control still works, progress against the remediation plan, the reason the fix is late, and a new date. If the owners cannot supply these, there is nothing to renew on, and the case goes up a level.

    In the pack

  12. Step

    Submit a late renewal now, scored as a new request

    Renewal is due before expiry. One made within the 10 working days after expiry is a late renewal: it may still be granted, but it is reported in the monthly review and the next quarterly report. Submit it at once. It is scored again on current facts and decided at the level its renewal count requires. The new expiry counts from the date the renewal is approved.

    In the pack

    See also

  13. Decision

    Is the renewal within the band's renewal limit?

    In the pack's defaults the same approver may renew a Low or Medium exception twice, and a High or Critical exception once. The count runs over the exception's whole life. Re-scoring, a change of band or a new owner does not reset it.

    In the pack

  14. Outcome

    The band's approver decides the renewal

    The approver may renew, shorten the period, add conditions or refuse. If it is refused, the requirement must be met and the gap is reported as a breach. Either way, the days between expiry and the decision stay recorded as non-compliance.

    In the pack

  15. Outcome

    It goes a level up and becomes chronic

    A renewal beyond the band's limit goes to the next approval level up. Once renewed past the limit, the exception is chronic, and it is reported by name in every quarterly report until it is closed.

    In the pack

    See also

  16. Outcome

    By working day 10, escalate to the next level up

    If the gap is neither fixed nor renewed by working day 10, information security escalates to the next approval level up. The escalation states the reference, the requirement, the band and the dates, and asks for a decision: fix, renew, or accept at a higher level. The exception is named in the quarterly report until it is resolved.

    In the pack

Practical checklist

  1. On the first working day after expiry, mark it Expired and tell the requester, risk owner and control owner.
  2. For a High or Critical exception, tell its approver the same day.
  3. Report the gap as non-compliance at the next monthly review.
  4. Keep the compensating controls running, and check that each still works.
  5. Close it only with dated evidence for every system named, checked by information security.
  6. Otherwise submit a late renewal with fresh control evidence, progress on the plan, the reason for the delay and a new date.
  7. Escalate to the next approval level up if nothing is resolved by working day 10, and name it in the quarterly report until it is resolved.

Evidence to have ready

  • The expiry notice and its date, and the approver's notification for a High or Critical exception.
  • The non-compliance entry in the monthly review, covering the days from expiry to resolution.
  • The closure evidence, or the late renewal with its new score, approval and expiry, noted as late.
  • Any escalation, stating the reference, requirement, band, dates and decision sought.

Assumptions

  • The exception was approved with a fixed expiry date and was neither closed nor renewed by that date.
  • The 10 working days and the other timings are the defaults in the CISO Times exception pack. Your own standard may set different ones.

Not covered here