Security exceptions need an expiry decision, not another reminder

The exception was meant to last until the legacy integration was replaced. A year later, the replacement has slipped, the original sponsor has left and the exception date has been extended twice. The register is current. The decision behind it is not.

For a security governance lead, this is the point where record-keeping needs to become active management. A temporary departure from a control can be reasonable. It remains reasonable only while its scope, business need and treatment still match the situation.

Separate acceptance from mitigation

An alternative control may meet the same intent through another method. A waiver may instead accept that the intended protection is missing for a period. Those are different positions and should not share a vague “approved exception” label.

Azure Policy makes a comparable distinction between mitigated exemptions and waivers. It also supports an expiry field: when that date arrives, the exemption is no longer honoured, while the record remains. The product behaviour illustrates why an expiry should have an operational meaning beyond sending an email.

Your organisation still has to define that meaning for each service. A governance register cannot safely assume that every expired item should trigger the same technical action. The disposition needs to account for business continuity as well as the exposure being accepted.

Write the exception so someone can challenge it

Describe the affected service, the requirement that is unmet and why normal treatment is not currently feasible. Explain what the interim control changes and what it leaves exposed. Name the person with authority to accept that residual position.

A useful hypothetical entry might say that a legacy application cannot support the required authentication method until a specific replacement milestone. Restricted access and additional monitoring reduce part of the exposure, but do not turn the old method into the required one. The sponsor accepts that bounded position while funding the transition.

That is more decision-useful than “MFA exception approved”. It gives a future reviewer something to test: is the application still in use, are the interim measures operating, and does the replacement milestone remain credible?

Make renewal a fresh choice

Before expiry, offer clear options: complete the planned treatment, restrict the affected service, replace the approach or renew with current evidence. A renewal should explain what changed and why the remaining alternative is still preferable.

Do not let an absent owner become automatic approval. Reassign the decision through the business escalation route. Keep overdue items visible until their disposition is confirmed, rather than removing them from the report because a date has passed.

Where a technical exemption exists in a platform, connect its identifier to the management record. Otherwise a risk committee may think an exception has ended while the platform configuration still excludes the resource from a control.

Use the register to expose a programme problem

One delayed exception can be a local delivery issue. Repeated renewals across the same technology may indicate that the organisation has never funded a workable transition or has set a control requirement the current operating model cannot implement.

Group those cases for a decision rather than sending more reminders to individual owners. The board reporting guide explains how to present the affected services, alternatives and resource request without reducing the issue to a count of overdue records.

Measure how exceptions change: closed through remediation, replaced by a different design, renewed with evidence or still awaiting authority. A falling total alone can conceal a scope change or missing records.

Keep silence out of the approval path

The register should make the next responsible decision unavoidable, not make renewal effortless. A proportionate exception process allows the business to keep operating while retaining a clear account of what it is accepting.

When the date arrives, somebody should be able to explain the disposition and show the corresponding service or platform outcome. That is what makes the exception temporary in practice.