Lesson 10 of 10 · About 4 minutes
Handle a security exception
Learn the concept.
Sometimes a team cannot meet a security requirement immediately. An exception makes the risk and decision visible; it does not make the risk disappear.
Keep an exception accountable
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Define the gap
The fictional team requests time to upgrade a legacy reporting tool.
- Evaluate remaining risk
The authorized owner reviews scope, interim safeguards, and possible consequences.
- Record the decision
If approved, document the owner, conditions, review triggers, and expiry. Approval does not mean the gap is fixed.
- Verify the ending
Verify remediation before closure. If unfinished, escalate for action or another authorized decision.
From request to closure
A fictional training example. Compare the observation with the conclusion.
- Propose
Gap, business need, safeguards, and remaining risk.
- Decide
Authorized owner records approval or rejection and conditions.
- Follow up
Review changes, verify remediation, and act before expiry.
Read the visualAn approved exception expires tomorrow and the fix is unfinished. What should happen?
The unresolved gap needs an explicit next decision. Expiry is not permission to ignore it.
Describe the specific gap
Record the affected system, unmet requirement, business reason, and possible harm. Keep the requested scope narrow.
Name the decision and safeguards
Send the request to the authorized risk owner under your organization’s process. Describe interim safeguards, remaining risk, and evidence that the safeguards operate. A requester cannot simply approve their own risk.
Give it an ending
Set the agreed expiry, review trigger, responsible owner, and remediation plan. Review changes early. Expiry requires action or a fresh authorized decision, not silent renewal.
Put it in context
Fictional case: a legacy reporting tool needs 30 days before a supported upgrade. The proposal limits it to a restricted network segment with reviewed access and monitoring. The risk owner must assess the remaining exposure and decide whether to approve. GRC tracks the decision, upgrade evidence, and expiry; it does not call the gap fixed merely because a ticket exists.
Make a decision.
Use what you just learned. A correct answer lets you save this lesson to your progress.
Take this with you.
An exception is a bounded, accountable decision with follow-up. Approval is not remediation.
Continue to the guided exercises