Policy exceptions longer than 30 days must go through formal approval before remaining active. What should the compliance admin configure?
Select an answer to reveal the explanation.
Short Explanation
A 31-day exception without a boss’s nod is just hope with a calendar. Put an approval workflow on exceptions that run past 30 days. Infinite self-extend, hard auto-close with no path, or parking them in SharePoint all dodge governance.
Full Explanation
Policy exception workflows enforce review and approval when temporary deviations persist beyond defined thresholds. For civic policy exceptions that exceed thirty days, configuring an approval workflow with designated approvers ensures risk owners and compliance stakeholders explicitly accept prolonged non-compliance before the exception remains active. Allowing any employee to extend exceptions indefinitely with only a comment fails by concept because unbounded self-extension removes governance gates and creates silent long-lived deviations. Auto-closing every exception at day thirty with no review path for justified extensions fails by concept because legitimate temporary needs (vendor delays, system cutovers) require a controlled extension path rather than hard stop without review. Moving long exceptions into an unmanaged SharePoint list outside IRM fails by concept because off-platform tracking breaks auditability and the Policy and Compliance lifecycle of record. Exam caveat: CIS-RC treats long-lived exceptions as governed approvals, not informal prolongations or shadow trackers. Operational check: configure approval for exceptions exceeding thirty days, create a test exception past the threshold, and verify it routes to Legal/Security (or designated) approvers before remaining active.