Criticality High Active

Exception Lifecycle Management

Establishes exception lifecycle including request, risk assessment, approval, documentation, monitoring, periodic review, renewal, expiration, closure, and continuous improvement for security and compliance exceptions.

Control ID
EXC-002
Domain Code
EXC
Control Nature
Corrective
Business Owner
CISO / Risk Owner
Category
Administrative
Compensating Control
Yes

Control Overview

EXC-002 · Full Control Profile
Business Description

Establish and maintain processes to request, assess, approve, document, monitor, periodically review, renew, expire, and close security and compliance exceptions throughout their lifecycle.

Business Objective

Ensure approved exceptions remain justified, risk-informed, time-bound, and appropriately governed until remediation or closure.

Business Benefits

    Business Risks if Missing

      Stakeholders, Industries & Technologies

      EXC-002 · Operating Context

      Primary Stakeholders

      Applicable Industries

      Applicable Technologies

      Mapped Regulatory & Industry Frameworks

      Harmonized Framework Mappings

      The following compliance and regulatory frameworks map directly to this control's governance scope.

      FRAMEWORK CODE FRAMEWORK NAME & DESCRIPTION FAMILY / CATEGORY VERSION ACTION
      RBI-CSF RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set...
      India
      Regulation
      		 vLatest View →
      PCI-DSS PCI DSS PCI DSS is an industry security standard maintaine...
      PCI
      Standard
      		 v4 View →
      COBIT2019 COBIT COBIT is an enterprise governance and management f...
      COBIT
      Governance Framework
      		 v2019 View →
      NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev...
      NIST
      Framework
      		 v2 View →
      NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i...
      NIST
      Control Catalog
      		 vRev. 5 View →
      SOC2 SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting...
      AICPA
      Audit Framework
      		 vLatest View →
      ISO27001 ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for...
      ISO
      Standard
      		 v2022 View →
      HIPAA Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement...
      US
      Law
      		 vCurrent View →
      GDPR General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin...
      EU
      Regulation
      		 vCurrent View →
      NPCI-ISR NPCI Information Security Requirements NPCI information-security requirements define cont...
      India
      Standard
      		 vLatest View →
      DORA Digital Operational Resilience Act The EU Digital Operational Resilience Act establis...
      EU
      Regulation
      		 vCurrent View →

      Parent Domain Context

      Governance Domain Baseline
      Domain Name:
      Exception Management (EXC)
      Purpose:
      To manage deviations from established policies and standards through a formal risk-based process.
      Scope:
      Enterprise
      View

      Compliance Requirements & Audit Crosswalk

      10 Specific Audit Clauses

      The following requirements dictate specific audit evidence criteria and testing steps mapped directly under this control.

      REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
      EXC-002-R001 Exception Request The organization shall submit exception... EXC-002 Exception Lifecycle Management Control Owner, Exception Requestor, Exception Manager View ↗
      EXC-002-R002 Exception Risk Assessment The organization shall conduct risk asse... EXC-002 Exception Lifecycle Management Risk Management, Security Risk Officer, Control Owner View ↗
      EXC-002-R003 Exception Approval The organization shall approve exception... EXC-002 Exception Lifecycle Management Authorized Exception Approver, CISO, Risk Management, Control Owner View ↗
      EXC-002-R004 Exception Documentation The organization shall maintain comprehe... EXC-002 Exception Lifecycle Management Exception Manager, GRC Administrator, Records Management View ↗
      EXC-002-R005 Exception Monitoring The organization shall monitor approved... EXC-002 Exception Lifecycle Management Control Owner, Exception Manager, Security Operations View ↗
      EXC-002-R006 Exception Periodic Review The organization shall conduct periodic... EXC-002 Exception Lifecycle Management Exception Owner, Control Owner, Risk Management View ↗
      EXC-002-R007 Exception Renewal The organization shall renew exceptions... EXC-002 Exception Lifecycle Management Exception Manager, Exception Owner, Risk Approver View ↗
      EXC-002-R008 Exception Expiration The organization shall manage exception... EXC-002 Exception Lifecycle Management Exception Manager, Control Owner, IT Operations View ↗
      EXC-002-R009 Exception Closure The organization shall close exceptions... EXC-002 Exception Lifecycle Management Control Owner, Exception Manager, Security Assurance View ↗
      EXC-002-R010 Continuous Improvement The organization shall establish a conti... EXC-002 Exception Lifecycle Management Exception Manager, CISO, Control Owners, Process Improvement Team View ↗