Security Exception Request & Approval Form

A — Request

Requester [[e.g. system owner, project lead]], with the risk owner

Before the rule is breached, or as soon as the gap is found

B — Risk assessment

Information security [[e.g. Head of Information Security]] (EX-04)

On receipt of a complete request

C — Decision and approval

The approver(s) for the band (EX-05)

Within the band's decision time

D — Renewal history

Information security

At each renewal (EX-08)

E — Closure

Requester or control owner; verified by information security

When the gap is closed or the exception ends (EX-13)

A2 Reachable from

Who can reach the weakness today: 'internet', 'the office network', 'three administrators'.

Left blank. An unknown answer is treated as 'internet' and raises the score.

A3 What is actually in place

One or two sentences on exactly what is not done: 'password only, no multi-factor sign-in, for all 38 users'.

'Non-compliant with policy' — the approver cannot see the gap.

A4 What happens if refused

The concrete effect: service stopped, revenue, contract or legal duty, for how long.

'The business needs it' — no basis for weighing the risk.

A6 End date

A date driven by the remediation plan. It will be capped by the band: longest Low 365 · Medium 180 · High 90 · Critical 30 days.

No end date, or 'until the system is replaced' with no date.

A7 How tested, and result

What was done to show the control works, when, by whom, and the result: 'sign-in from outside refused on 2 October, screenshot attached'.

'Configured' or 'in place'. Configuration is not a test.

B2 Reason

One line per rating, pointing to the anchor in the model.

—

A1 Requester and ownership

Requester

name and role

[[Name, role]]

Date submitted

[[YYYY-MM-DD]]

Risk owner

the accountable executive for the affected service

[[Name, role]]

Register reference

given by information security

[[EX-YYYY-nnn]]

Control owner

who runs the control not being met

[[Name, role]]

New or renewal?

if renewal, see Part D

[[New / Renewal of EX-…]]

A2 What is affected

Systems or services

names and asset IDs

[[System names, asset IDs]]

Data

type, volume, classification

[[e.g. customer personal data, about n records, Confidential]]

Users and locations

who uses it

[[e.g. all staff; finance team; one site]]

Reachable from

internet, partners, all staff, administrators only

[[Internet / partner networks / internal network / administrators only]]

Service provider involved?

name, and who configures it

[[No / Yes — provider name]]

A3 The rule not met

Policy or standard

document ID and title

[[Document ID, title]]

Clause or rule

section or rule number

[[e.g. section 5.3]]

What the rule requires

in your own words

[[What the rule requires]]

What is actually in place

the gap, precisely

[[What is done instead, and what is not done]]

A4 Reason and business justification

Why the rule cannot be met now

[[Technical, contractual or business reason]]

What happens if refused

service, customers, cost, legal

[[Effect on the business if the exception is refused]]

Cost and effort to comply now

[[Estimate, and whether it is budgeted]]

A5 Alternatives considered | at least two, and why each was not chosen

Alternative 1

[[What it is — why it was not chosen]]

Alternative 2

[[What it is — why it was not chosen]]

Alternative 3

optional

[[What it is — why it was not chosen]]

A6 Duration and remediation plan

Start date

[[YYYY-MM-DD, or 'on approval']]

End date requested

capped by band — see Part C

[[YYYY-MM-DD]]

How the gap will be closed

steps and dates

[[Remediation steps, with target dates]]

Remediation owner

[[Name, role]]

A7 Compensating controls | what reduces the risk while the gap is open, and the proof it works

Control 1

what it is

[[Control]]

Owner

[[Name]]

How tested, and result

[[Test performed and result]]

Evidence and date

[[Reference, YYYY-MM-DD]]

Control 2

what it is

[[Control]]

Owner

[[Name]]

How tested, and result

[[Test performed and result]]

Evidence and date

[[Reference, YYYY-MM-DD]]

A8 Declaration

Requester

the information above is complete and accurate

[[Signature, date]]

Risk owner

I own this risk while the exception is open

[[Signature, date]]

B1 Checks before scoring

Request complete?

incomplete requests are returned

[[Yes — YYYY-MM-DD / Returned on YYYY-MM-DD]]

Allowed?

not an item that may never be excepted (EX-02)

[[Yes / No — refuse]]

Related exceptions

on the same system or owner

[[References, or none]]

B2 Score

Impact

1 Minor · 2 Moderate · 3 Major · 4 Severe

[[1–4]]

Reason

[[Why this level]]

Likelihood before controls

1 Unlikely · 2 Possible · 3 Likely · 4 Almost certain

[[1–4]]

Reason

[[Why this level]]

Effective, tested control?

EX-07: lowers likelihood one step, never below 1

[[Yes — which / No]]

Evidence checked

[[Reference, date]]

Likelihood after controls

[[1–4]]

Score

impact × likelihood after

[[1–16]]

Band

Low 1–3 · Medium 4–6 · High 8–9 · Critical 12–16

[[Low / Medium / High / Critical]]

Must sign

from the table in Part C

[[Approver(s) for the band]]

Longest duration

days: Low 365 · Medium 180 · High 90 · Critical 30

[[n days]]

Decision due by

band's decision time: working days from a complete request

[[YYYY-MM-DD]]

Recommendation

approve, approve with conditions, or refuse — and why

[[Recommendation to the approver]]

Assessed by

[[Name, role]]

Date

[[YYYY-MM-DD]]

Low

1–3

Control owner

365 days

5

2

Medium

4–6

Head of Information Security

180 days

10

2

High

8–9

Head of Information Security and the accountable executive (risk owner)

90 days

10

1

Critical

12–16

The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management

30 days

5

1

C1 Decision

Decision

[[Approved / Approved with conditions / Refused]]

Conditions

[[Conditions attached, or none]]

Approved from

[[YYYY-MM-DD]]

Expires on

no later than approval date + band's longest duration

[[YYYY-MM-DD]]

Reason if refused

[[Reason, and what the requester must do instead]]

C2 Signatures

Approver

the band's approver

[[Name, role]]

Signature and date

[[Signature, date]]

Second approver

High band: the accountable executive (risk owner)

[[Name, role — or not required]]

Signature and date

[[Signature, date]]

Critical band

executive management decision

[[Body and meeting — or not required]]

Minute or decision reference

[[Reference]]

Recorded in the register by

[[Name, date]]

Expiry reminder set for

30 days before expiry (EX-09)

[[YYYY-MM-DD]]

1

[[YYYY-MM-DD]]

[[Score, band]]

[[What was done; why more time is needed]]

[[Name, role]]

[[YYYY-MM-DD]]

2

[[YYYY-MM-DD]]

[[Score, band]]

[[What was done; why more time is needed]]

[[Name, role]]

[[YYYY-MM-DD]]

Beyond the band's limit

[[YYYY-MM-DD]]

[[Score, band]]

[[Why the gap is still open — reported as chronic]]

[[Next approval level up]]

[[YYYY-MM-DD]]

E1 Closure

Why it is closing

[[Rule now met / system retired / requirement formally changed / refused at renewal]]

How the rule is now met

[[What changed]]

Evidence

[[Reference, date]]

Compensating controls

kept or removed, and when

[[Kept / removed on YYYY-MM-DD]]

Closed before expiry?

if not, days expired (EX-10)

[[Yes / No — n days]]

Register entry closed

[[YYYY-MM-DD]]

Verified by

information security

[[Name, role]]

Signature and date

[[Signature, date]]

A1 Requester and ownership — EXAMPLE

Requester

name and role

Amira Patel, Sales Operations Manager

Date submitted

2026-10-05

Risk owner

the accountable executive for the affected service

Tom Reilly, Sales Director

Register reference

given by information security

EX-2026-014

Control owner

who runs the control not being met

Jon Evans, IT Operations Manager

New or renewal?

if renewal, see Part D

New

A2 What is affected — EXAMPLE

Systems or services

names and asset IDs

Customer relationship management service (software as a service), asset ID SAAS-007

Data

type, volume, classification

About 12,000 customer contact records and sales notes. Personal data; classified Confidential

Users and locations

who uses it

38 sales and customer service staff

Reachable from

internet, partners, all staff, administrators only

Internet: the sign-in page is public

Service provider involved?

name, and who configures it

Yes — the service's vendor hosts it; configured by Sales Operations

A3 The rule not met — EXAMPLE

Policy or standard

document ID and title

ISMS-STD-004 Access Control Standard

Clause or rule

section or rule number

Section 5.3

What the rule requires

in your own words

Multi-factor sign-in for every internet-facing service that holds personal data.

What is actually in place

the gap, precisely

Password only. The current subscription does not offer multi-factor sign-in or single sign-on.

A4 Reason and business justification — EXAMPLE

Why the rule cannot be met now

Only the vendor's higher subscription tier supports single sign-on. The upgrade needs a budget change and a contract amendment, which take about ten weeks.

What happens if refused

service, customers, cost, legal

Sales would lose access to customer history for up to ten weeks; about 60 quotes a week are prepared from it.

Cost and effort to comply now

Upgrade: 38 users at the higher tier, about [[amount]] a year more. Approved in the Q4 budget on 1 October.

A5 Alternatives considered | at least two, and why each was not chosen — EXAMPLE

Alternative 1

Move to another service now — rejected: data migration and retraining take longer than the upgrade.

Alternative 2

Suspend access until upgraded — rejected: stops quoting for ten weeks.

Alternative 3

optional

Upgrade immediately mid-contract — not offered by the vendor before the contract anniversary.

A6 Duration and remediation plan — EXAMPLE

Start date

On approval

End date requested

capped by band — see Part C

2027-01-31

How the gap will be closed

steps and dates

Contract amendment signed by 13 November; single sign-on configured and tested by 2026-12-18; this exception closed the same week.

Remediation owner

Amira Patel

A7 Compensating controls | what reduces the risk while the gap is open, and the proof it works — EXAMPLE

Control 1

what it is

Sign-in allowed only from the office and VPN addresses (the service's own address restriction setting)

Owner

Jon Evans

How tested, and result

Sign-in attempt from a mobile network on 2026-10-02 was refused; attempt from the office succeeded. Screenshots attached

Evidence and date

EX-2026-014-E1, 2026-10-02

Control 2

what it is

Password policy of 14 characters and a staff reminder

Owner

Amira Patel

How tested, and result

Not tested — a policy setting, not a control on how the gap is used

Evidence and date

—

A8 Declaration — EXAMPLE

Requester

the information above is complete and accurate

A. Patel, 2026-10-05

Risk owner

I own this risk while the exception is open

T. Reilly, 2026-10-05

B1 Checks before scoring — EXAMPLE

Request complete?

incomplete requests are returned

Yes — 2026-10-05

Allowed?

not an item that may never be excepted (EX-02)

Yes — not listed in EX-02

Related exceptions

on the same system or owner

None on this system

B2 Score — EXAMPLE

Impact

1 Minor · 2 Moderate · 3 Major · 4 Severe

3

Reason

Customer personal data at scale; notifiable if misused (Major).

Likelihood before controls

1 Unlikely · 2 Possible · 3 Likely · 4 Almost certain

4

Reason

Public sign-in page; password-guessing against such services is constant (Almost certain).

Effective, tested control?

EX-07: lowers likelihood one step, never below 1

Yes — control 1

Evidence checked

EX-2026-014-E1: refused sign-in, dated 5 days before assessment

Likelihood after controls

3

Score

impact × likelihood after

3 × 3 = 9

Band

Low 1–3 · Medium 4–6 · High 8–9 · Critical 12–16

High

Must sign

from the table in Part C

Head of Information Security and the accountable executive (risk owner)

Longest duration

days: Low 365 · Medium 180 · High 90 · Critical 30

90 days

Decision due by

band's decision time: working days from a complete request

2026-10-19

Recommendation

approve, approve with conditions, or refuse — and why

Approve until 2027-01-10, not the requested 2027-01-31: the band allows 90 days. Condition: the address restriction is checked at each monthly register review. Note: with control 2 alone the score would be 12 (Critical).

Assessed by

Priya Shah, Head of Information Security

Date

2026-10-07

Low

1–3

Control owner

365 days

5

2

Medium

4–6

Head of Information Security

180 days

10

2

High

8–9

Head of Information Security and the accountable executive (risk owner)

90 days

10

1

Critical

12–16

The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management

30 days

5

1

C1 Decision — EXAMPLE

Decision

Approved with conditions

Conditions

The address restriction stays in place and is re-tested monthly; any change to it is reported to Information Security the same day.

Approved from

2026-10-12

Expires on

no later than approval date + band's longest duration

2027-01-10

Reason if refused

—

C2 Signatures — EXAMPLE

Approver

the band's approver

Priya Shah, Head of Information Security

Signature and date

P. Shah, 2026-10-12

Second approver

High band: the accountable executive (risk owner)

Tom Reilly, Sales Director (accountable executive, risk owner)

Signature and date

T. Reilly, 2026-10-12

Critical band

executive management decision

Not required (High band)

Minute or decision reference

—

Recorded in the register by

Priya Shah, 2026-10-12

Expiry reminder set for

30 days before expiry (EX-09)

2026-12-11

Security Exception & Waiver Standard

The rules this form applies: when an exception is needed and allowed, approval by band, duration, renewals and closure (EX-01 to EX-13)

Exception Lifecycle Operating Procedure

The procedure that governs this form: the steps from request to closure

Exception Risk Scoring & Expiry Model

How Part B is scored, and what each band sets

Security Exception Register

Where every request, decision, expiry and closure is recorded

SoD Conflict Review & Compensating Control Procedure

Uses this form to record segregation-of-duties conflicts that cannot be separated

ISO/IEC 27001:2022

Annex A 5.36 — Compliance with policies, rules and standards for information security

Whole form: departures from policy requested, approved and recorded

NIST CSF 2.0

GV.RM-06 — “A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated”

Part B: the standard scoring method applied to each request

NIST CSF 2.0

ID.RA-06 — “Risk responses are chosen, prioritized, planned, tracked, and communicated”

Parts C to E: the decision, its tracking, renewal and closure

NIST CSF 2.0

ID.RA-07 — “Changes and exceptions are managed, assessed for risk impact, recorded, and tracked”

Whole form: each exception assessed for risk (Part B), recorded and tracked (Parts C to E)

DORA — Delegated Regulation (EU) 2024/1774

Article 2(2)(c)(ii) and (iii) — ICT security policies record exceptions from their implementation and keep resilience assured while exceptions exist

Whole form: exceptions recorded, with compensating controls (A7)

Band

The range the score falls in — Low (1–3), Medium (4–6), High (8–9), Critical (12–16) — which sets the approver, the longest duration, the decision time and the number of renewals.

Compensating control

A measure that reduces the risk of the gap while it remains open. An effective, tested one lowers likelihood by one step (EX-07).

Exception

An approved, time-limited decision that a rule in a policy or standard need not be met in a stated scope, with a named owner, compensating controls and an expiry date.

Expiry date

The date the exception ends unless renewed: no later than the approval date plus the band's longest duration.

Renewal

A new decision, on a new score, to extend an exception past its expiry date.

Risk owner

The accountable business executive for the affected service, who owns the risk while the exception is open.

Score

Impact multiplied by likelihood after compensating controls, each rated 1 to 4, as set out in the model.

Tested

Shown to work by dated evidence taken after the control was put in place.