Security Exception Request Template

WHEN TO USE IT When a system cannot meet a security standard and shipping anyway is the considered decision. The alternative in practice is not compliance — it is an undocumented gap that nobody owns and nobody revisits, which is strictly worse. Use it for the case you intend to fix. A permanent divergence is not an exception; it is a change to the standard, and should be argued as one. HOW TO USE IT The system owner requests; a security approver with the authority to accept the risk approves. Both names go on the record. Every exception gets an expiry date — no exceptions to that rule, because an undated exception is a permanent decision nobody consciously made. Review the register on a cadence. The number of expired-but-still-open exceptions is one of the most honest security metrics an organisation has. THE TEMPLATE # Security exception: <control or standard not met> Requester: <name> System: <name> Tier: <business criticality> Approver: <name and role> Expires: <yyyy-mm-dd> ## The control not being met Quote the specific requirement, not a paraphrase. ## Why it cannot be met now Technical or commercial reason. "No time" is an honest answer and should be written down as one. ## Exposure What an attacker gains from this gap, and what would have to be true for it to be exploited. Be specific about data and blast radius. ## Compensating controls What reduces the exposure in the meantime, and who verified it works. An exception with no compensating control is an accepted risk — say so plainly rather than listing something that does not help. ## Plan to close The work, the owner and the date. If there is no plan, this is a risk acceptance and belongs in the risk register instead. ## Expiry and review Date this lapses. On that date the exception is void, not extended by default. Extensions are a new request with a new approval. ADAPTING IT Map the approver's authority to the exposure: a low-tier system's exception should not require the same signature as a payment path. Where a regulator is involved, add the reporting obligation explicitly. The expiry date and the named approver are the two fields that make this a control rather than a note. See /secops for the operational side, /complianceops for the evidence, and /grcops for the register these feed.