Criticality Critical Active

Exception Management Program

Establishes exception management program including governance, scope, roles, policy, risk governance, metrics, reporting, review, compliance, and continuous improvement.

Control ID
EXC-001
Domain Code
EXC
Control Nature
Corrective
Business Owner
CISO / Business Owner
Category
Administrative
Compensating Control
Yes

Control Overview

EXC-001 · Full Control Profile
Business Description

Establish and maintain an enterprise exception management program to govern the identification, evaluation, approval, monitoring, renewal, and closure of approved deviations from security, privacy, risk, and compliance requirements.

Business Objective

Ensure business exceptions are managed consistently while maintaining visibility, accountability, and acceptable organizational risk.

Business Benefits

    Business Risks if Missing

      Stakeholders, Industries & Technologies

      EXC-001 · Operating Context

      Primary Stakeholders

      Applicable Industries

      Applicable Technologies

      Mapped Regulatory & Industry Frameworks

      Harmonized Framework Mappings

      The following compliance and regulatory frameworks map directly to this control's governance scope.

      FRAMEWORK CODE FRAMEWORK NAME & DESCRIPTION FAMILY / CATEGORY VERSION ACTION
      ISO27001 ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for...
      ISO
      Standard
      		 v2022 View →
      RBI-CSF RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set...
      India
      Regulation
      		 vLatest View →
      COBIT2019 COBIT COBIT is an enterprise governance and management f...
      COBIT
      Governance Framework
      		 v2019 View →
      NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev...
      NIST
      Framework
      		 v2 View →
      NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i...
      NIST
      Control Catalog
      		 vRev. 5 View →
      SOC2 SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting...
      AICPA
      Audit Framework
      		 vLatest View →
      PCI-DSS PCI DSS PCI DSS is an industry security standard maintaine...
      PCI
      Standard
      		 v4 View →
      NPCI-ISR NPCI Information Security Requirements NPCI information-security requirements define cont...
      India
      Standard
      		 vLatest View →
      DORA Digital Operational Resilience Act The EU Digital Operational Resilience Act establis...
      EU
      Regulation
      		 vCurrent View →
      HIPAA Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement...
      US
      Law
      		 vCurrent View →

      Parent Domain Context

      Governance Domain Baseline
      Domain Name:
      Exception Management (EXC)
      Purpose:
      To manage deviations from established policies and standards through a formal risk-based process.
      Scope:
      Enterprise
      View

      Compliance Requirements & Audit Crosswalk

      10 Specific Audit Clauses

      The following requirements dictate specific audit evidence criteria and testing steps mapped directly under this control.

      REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
      EXC-001-R001 Exception Governance Framework The organization shall establish an exce... EXC-001 Exception Management Program Risk & Compliance, CISO, Exception Management Committee View ↗
      EXC-001-R002 Program Scope The organization shall define a document... EXC-001 Exception Management Program Exception Manager, CISO, Compliance, Control Owners View ↗
      EXC-001-R003 Roles & Responsibilities The organization shall clearly define an... EXC-001 Exception Management Program Exception Manager, Control Owners, Risk Management, CISO View ↗
      EXC-001-R004 Exception Policy The organization shall establish an exce... EXC-001 Exception Management Program CISO, Compliance, Risk Management, Policy Owner View ↗
      EXC-001-R005 Risk Governance The organization shall establish governa... EXC-001 Exception Management Program Chief Risk Officer, CISO, Risk Management, Exception Approvers View ↗
      EXC-001-R006 Exception Metrics The organization shall define and track... EXC-001 Exception Management Program Exception Manager, Risk Management, CISO View ↗
      EXC-001-R007 Executive Reporting The organization shall provide executive... EXC-001 Exception Management Program CISO, Chief Risk Officer, Board Risk Committee, Exception Manager View ↗
      EXC-001-R008 Program Review The organization shall conduct periodic... EXC-001 Exception Management Program Exception Manager, CISO, Risk Management, Internal Audit View ↗
      EXC-001-R009 Program Compliance The organization shall ensure the except... EXC-001 Exception Management Program Compliance Officer, CISO, Legal, Exception Manager View ↗
      EXC-001-R010 Continuous Improvement The organization shall establish a conti... EXC-001 Exception Management Program Exception Manager, CISO, Control Owners, Process Improvement Team View ↗