A department obtains a policy exception for an unmet encryption control. What must the architecture prevent?
Select an answer to reveal the explanation.
Short Explanation
An exception is a hall pass with an expiration stamp—not a magic eraser. It must stay visible and time-bound. Never let it quietly paint the control green as if the gap never existed.
Full Explanation
Policy exceptions document approved deviations and must remain visible, owned, and typically time-bound in the compliance architecture. They must not silently set controls to Effective or otherwise falsify posture. Transparent exception handling lets leadership and examiners see residual exposure while remediation or compensating measures continue.