A clinic department requests temporary relief from MFA policy for a legacy application. How should IRM handle the request?
Select an answer to reveal the explanation.
Short Explanation
Exceptions are hall passes, not forged IDs. Record the MFA exception, get approval, limit the scope, and put an expiry on it. Quiet side doors and permanent citywide rewrites are how temporary pain becomes permanent risk.
Full Explanation
Policy exceptions provide a controlled lifecycle for time-bound deviations: request, approval, scoped applicability, and expiration or review. That preserves policy integrity while acknowledging legacy constraints. Silent noncompliance, permanent dilution of the policy for all users, or falsifying citations are not acceptable exception practices.