Nested Knowledge

Bringing Systematic Review to Life

User Tools

Site Tools

Trace:
wiki:policies:exception

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
Last revision Both sides next revision
wiki:policies:exception [2023/02/07 21:13]
katcow 		wiki:policies:exception [2023/02/07 21:32]
katcow
Line 2: Line 2:
  
  
 +===== Purpose =====
 +
 +The purpose of this policy is to ensure that exceptions to security policies are documented and approved through an exception process. 
  
 ===== Scope ===== ===== Scope =====
Line 11: Line 14:
 An exception to an information security policy may be granted in the following cases:  An exception to an information security policy may be granted in the following cases: 
  
-  * a more secure solution exists+  * The implicated system does not have the capacity to comply with the relevant security standard.  
 +  * Immediate compliance would disrupt critical business 
 +  * A more secure or superior solution exists 
 +  * Compliance would adversely affect business operations 
 +  * A lawsuit or investigation requires exception to the relevant security policy.  
 +  * Compliance would cause a major adverse financial loss 
 +  * An emergency situation requires violation of the relevant security policy.
  
- +=== To Request an Exception: ===
-To request an exceptions: +
  
 Email or slack the [[wiki:policies:infosec#information_security_organization|information security team]] to request an exception. You request must contain the following information:  Email or slack the [[wiki:policies:infosec#information_security_organization|information security team]] to request an exception. You request must contain the following information: 
Line 27: Line 35:
   * Controls in place to mitigate risks.    * Controls in place to mitigate risks. 
  
-**Example: **+=== Example Exception Request ===
  
-* Steve would like to share Carl's Planet Pizza Account to order Pies for after-hour work events. This violates our access control policy, which Steve is well-acquainted with, as he pays close attention during annual trainings.  Steve's request might look like the following: +Steve would like to share Carl's Pizza Planet Account to order Pies for after-hour work events. This violates our access control policy, which Steve is well-acquainted with, as he pays close attention during annual trainings.  Steve's request might look like the following: 
  
-  * Request: I would like shared access to Karl's Planet Pizza online Accounts.  +  * Request: I would like share access to Carl's Pizza Planet online account.  
-  * Policy: Attaching the access control policy : [[https://wiki.nested-knowledge.com/doku.php?id=wiki:policies:access]] +  * Policy: I'm attaching the access control policy: [[https://wiki.nested-knowledge.com/doku.php?id=wiki:policies:access]] 
-  * Application; this affects our account on the Planet Pizza web application.  +  * Device/Application: Carl's account on the Pizza Planet web application, accessible at the website: [[https://www.pizza-planet.org/portal]].  
-  * Rationale: Planet Pizza only permits one account per each business credit card.+  * Rationale: Pizza Planet only permits one account per each business credit card.
   * Duration: Four - Six months.    * Duration: Four - Six months. 
-  * Risk: Passwords shared online may be intercepted, compromising our account and credit card information.  +  * Risk: Passwords shared online may be intercepted, compromising Carl's account and our business credit card information. 
-  * Mitigation:  +  * Mitigation: To limit risks, credentials will be shared face-to-face verbally. We will change the account password every 6-8 weeks. 
-----+
  
- 
-* For example, attach the Access Control Policy if you are requesting to share an account to a software platform with another employee. 
  
 ===== Revision History ===== ===== Revision History =====
 +
 +
 +^Author^Date of Revision/Review^Comments/Description|
 +|K. Cowie|02/07/2023|Draft Completed|
 +
 +
 +[[:wiki:policies|Return to Policies]]
 +
wiki/policies/exception.txt · Last modified: 2023/02/07 21:46 by katcow

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki