Information Security Policy Exceptions Form

INFORMATION SECURITY POLICY EXCEPTIONS FORM

This Information Security Policy Exceptions Form (the "Form") is made and entered into by and between Requesting Party: and Information Security Authority: , effective as of .

RECITALS

WHEREAS, the organization maintains an Information Security Policy (the "Policy") that establishes mandatory technical, administrative and physical controls to protect information assets; and

WHEREAS, the Requesting Party seeks an exception from a specific Policy requirement for a defined system, application, process or activity, and has submitted a request that identifies compensating controls and risk acceptance measures; and

WHEREAS, the Information Security Authority is empowered to review, grant, deny or grant conditional exceptions consistent with organizational risk management practices;

NOW THEREFORE, in consideration of the mutual covenants set forth below, the parties agree as follows.

1. EXCEPTION REQUEST

2. BUSINESS JUSTIFICATION

Provide a concise and specific business justification for the requested exception, demonstrating why compliance with the Policy is not feasible, would cause material business disruption, or would produce disproportionate cost relative to risk mitigation.

3. RISK ASSESSMENT

The Requesting Party shall obtain or document a risk assessment that identifies potential impacts to confidentiality, integrity and availability and recommends compensating controls.

Low Medium High

4. COMPENSATING CONTROLS & MITIGATION

Describe controls that will be implemented to mitigate the increased risk resulting from the exception. Controls must be specific, measurable and subject to review.

5. DURATION, REVIEW & RENEWAL

Exceptions are time-limited and subject to periodic review. Continued noncompliance requires a renewal request and subsequent approval.

Renewal required at expiration: Yes No

6. APPROVAL DETERMINATION

The Information Security Authority will document its determination by selecting one of the following and, if applicable, stating conditions of approval.

Approved Denied Approved with Conditions

7. RESPONSIBILITIES

The Requesting Party remains responsible for implementing approved compensating controls, maintaining evidence of compliance with conditions, and reporting incidents or control failures to the Information Security Authority.

8. NOTICES

Notices required under this Form shall be in writing and delivered to the contacts below.

9. GOVERNING PROVISIONS

Governing Law: This Form and the parties' rights and obligations hereunder shall be governed by and construed in accordance with the laws of the jurisdiction in which the organization is incorporated, without regard to conflicts of law principles.

Entire Agreement: This Form contains the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings related to the exception requested.

Severability: If any provision of this Form is held to be invalid or unenforceable, the remainder of this Form will continue in full force and effect and such provision will be reformed only to the extent necessary to make it enforceable.

Amendments and Waiver: Any amendment or waiver of any provision of this Form must be in writing and signed by both parties. No failure or delay by either party in exercising any right shall operate as a waiver of that right.

Counterparts: This Form may be executed in counterparts, each of which shall be deemed an original but all of which together shall constitute one and the same instrument.

10. CERTIFICATION

By signing below, the Requesting Party certifies that the information provided in this Form is true and complete to the best of their knowledge, that compensating controls will be implemented as described, and that the Requesting Party accepts responsibility for compliance with any conditions attached to an approved exception. The Information Security Authority certifies that it has the authority to render the approval decision recorded below.

Sign Now