Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who approves a Critical exception in an organisation shaped like ours?

4 decision pointsThe pack behind this answer: Security Exception, Waiver & Segregation of Duties

Add to board memo

The short answer

Recommendation
Name the approver from your structure: the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; executive management where there is no board. Whoever it is, the risk owner presents the request and nobody decides an exception they asked for.
Reasoning
A Critical gap is one the organisation should not live with for long, so the decision to fix, contain or accept it belongs at the top, and quickly. Who the top is depends on how you are governed, so name the body in your exception standard before you need it. A delegated committee decides only within the authority the board gave it. The independence rule gives the approval its value: a conflicted member steps out, and silence is never approval.
Considerations
  • The 5-working-day decision time and the 30-day maximum with one renewal are the defaults in the CISO Times exception pack. Your own standard may set different ones.
  • Check the score first. A tested compensating control the assessor missed lowers likelihood one step and can move the exception to High.
  • If you are regulated under NIS2 or DORA, the pack's guidance is to name the management body as the Critical approver and record the standard in your ICT risk management framework.
  • Where a conflicted member stepping out leaves nobody, the approval passes up a level or to whoever your standard names to sign instead. Where no higher body exists, the pack does not say who that should be.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartAn exception has scored CriticalDecisionDoes your organisation have a board above its executives?OutcomeExecutive management approvesDecisionIs it a two-tier structure, with a separate management board?OutcomeThe management board approvesDecisionHas the board delegated these decisions to a risk committee?OutcomeThe board risk committee approvesOutcomeThe board itself approvesDecisionIs the approver also the requester, or does it run the control?StepConflicted member steps out, or it passes upOutcomeRisk owner presents it; decision within 5 working days

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 11 steps.

  1. Start

    An exception has scored Critical

    Critical means a severe gap that is likely or almost certain to be used while it is open, or a major gap that is almost certain to be. The organisation should decide at the top, and quickly, whether to fix it, contain it or accept it. Check the score before looking for an approver: a tested compensating control the assessor missed lowers likelihood one step and can move the exception to High.

    In the pack

    See also

  2. Decision

    Does your organisation have a board above its executives?

    A board here is a governing body that oversees the people who run the business day to day. Many small and owner-managed companies have none in practice: the owners or partners run the business themselves. Answer from how decisions are actually made and from your constitution.

    In the pack

  3. Outcome

    Executive management approves

    Where there is no board, the Critical approver is executive management. In a small firm that may be the owners, the partners or the managing director. Record it as a decision of that group with a reference, such as the minute of the partners' meeting. Name the group in your exception standard.

    In the pack

  4. Decision

    Is it a two-tier structure, with a separate management board?

    In a two-tier structure a supervisory board oversees a separate management board that runs the company. There the pack's standard names the management board as the Critical approver.

    In the pack

  5. Outcome

    The management board approves

    Name the management board in your exception standard as the Critical approver. Check it can decide within 5 working days, for example by written procedure between meetings. If you are regulated under NIS2 or DORA, the pack's guidance is to name the management body as the Critical approver and to record the standard in your ICT risk management framework.

    In the pack

  6. Decision

    Has the board delegated these decisions to a risk committee?

    A board may give Critical exception decisions to a board risk committee, so they need not wait for a full board meeting. The committee decides only within the authority the board gave it. If you cannot point to that delegation, treat the answer as no.

    In the pack

  7. Outcome

    The board risk committee approves

    The committee decides on the board's behalf. Name it in your exception standard, and check it can meet the 5-working-day decision time. If you are regulated under NIS2 or DORA, the pack's guidance is to take Critical exceptions to the management body itself.

    In the pack

  8. Outcome

    The board itself approves

    Name the board in your exception standard as the Critical approver. Most boards meet on a schedule, so agree now how it decides between meetings within 5 working days: by written procedure, or by delegating Critical decisions to a named committee.

    In the pack

  9. Decision

    Is the approver also the requester, or does it run the control?

    Nobody may approve an exception they requested, or one to a control they operate. In a small firm the managing director can easily be both requester and approver. If you are not sure, treat the answer as yes.

    In the pack

  10. Step

    Conflicted member steps out, or it passes up

    Where the approver is a body, a member who requested the exception or runs its control declares the interest and takes no part, and the rest of the body decides. Where that leaves nobody, as in many owner-managed firms, the approval passes to the next level up, or to whoever your standard names to sign instead. Record who actually signed. Where no higher body exists, the pack does not say who that should be.

    In the pack

  11. Outcome

    Risk owner presents it; decision within 5 working days

    The risk owner presents the request and its assessment. The body decides in writing: approve, approve for less time or with conditions, or refuse. In the pack's defaults it decides within 5 working days of a complete request, for at most 30 days, with one renewal. Silence is never approval: an undecided request goes up a level. Put the body and its minute or decision reference on your form.

    In the pack

    See also

Practical checklist

  1. Confirm the score is Critical and that any tested control has been counted.
  2. Work out from your constitution, and how decisions are actually made, whether you have a single board, a two-tier structure or no board.
  3. Where there is a single board, check whether it has delegated Critical exceptions to a risk committee. If you cannot show the delegation, the board decides.
  4. Name the approving body in your exception standard, and agree how it decides between meetings within the decision time.
  5. Have any member who requested the exception or runs its control declare the interest and take no part.
  6. Have the risk owner present the request and assessment, and get a written decision with an expiry date.
  7. Escalate an undecided request to the next level up when the decision time passes.

Evidence to have ready

  • Your exception standard naming the Critical approver, and any board delegation to a committee.
  • The minute or decision reference of the body that decided, with the decision, any conditions and the expiry date.
  • Any declared interests, who took part, and who actually signed.
  • The dates the request became complete and was decided.

Assumptions

  • The exception has already been scored Critical, 12 to 16 on the pack's 4 × 4 scale.
  • Your constitution or articles decide which governing bodies you have. This flow helps you name the right one in your exception standard.
  • Decision times and durations are the defaults in the CISO Times exception pack. Your own standard may set different ones.

Not covered here