A clinic department requests temporary relief from MFA policy for a legacy application. How should IRM handle the request?
Select an answer to reveal the explanation.
Short Explanation
Exceptions are hall passes, not forged IDs. Record the MFA exception, get approval, limit the scope, and put an expiry on it. Quiet side doors and permanent citywide rewrites are how temporary pain becomes permanent risk.
Full Explanation
Policy exceptions provide a controlled lifecycle for time-bound deviations: request, approval, documented scope, and an expiration or review date. When a clinic department requests temporary relief from MFA policy for a legacy application, IRM should use that exception lifecycle rather than informal workarounds. Silently ignoring the policy for that app with no record or expiry creates unmanaged risk and no audit trail. Permanently rewriting the citywide MFA policy to remove MFA for everyone overreacts to a local legacy constraint and weakens the baseline for all other systems. Creating a citation that falsely claims MFA is not required under any mandate corrupts the authority content and misleads future mapping. Exam caveat: exceptions mitigate process friction—they do not replace compensating controls or formal risk acceptance where those are also required by municipal policy. Operational check: file the exception against the MFA policy with clinic scope and end date, route approvals, link related controls or issues, calendar the expiry review, and report open exceptions alongside compliance posture for health leadership. On expiry, either remediate MFA on the legacy app, renew with approval, or close with verified compliance, and retain the packet for auditors.