When to use this
Use this record when a system cannot comply with an approved configuration baseline and the deviation needs risk-based approval.
Related controls
Exception record
| Field | Value |
|---|---|
| System/service | TBD |
| Baseline/control not met | TBD |
| Reason for deviation | TBD |
| Risk created | TBD |
| Compensating controls | TBD |
| Approved by | TBD |
| Expiry/review date | TBD |
| Monitoring required | TBD |
Minimum checks
- Deviation is specific.
- Business or technical reason is documented.
- Risk is assessed.
- Compensating controls are defined.
- Expiry/review date is set.
- Template
- Iso27001
- Technological controls
- Configuration management
- Risk acceptance
Note Metadata
Aliases: Configuration Deviation Record
Source: 90 Templates/Configuration Exception and Risk Acceptance Record.md