A business unit cannot meet the encryption standard on a legacy production system until its planned replacement next year, and it asks to operate the system without compliance. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
An exception is a hall pass, not a free pass. You write down the risk, get the right person to sign it and put an expiry date on it, rather than waving the unit through or rewriting the rules for one old box.
Full Explanation
Standards are mandatory, but situations arise in which compliance is not feasible for a period. A formal exception process allows the business to continue operating while keeping the risk visible and controlled. The deviation should be documented with its rationale and the resulting risk, any compensating controls should be identified, approval should come from an authority with the power to accept that level of risk, and the exception should expire on a defined date, here aligned with the planned replacement, after which it is reviewed. Allowing the deviation informally leaves no record, no approval and no review, so the risk is unmanaged and the exception can persist long after the replacement date slips. Refusing any exception ignores that the business cannot comply now; it may lead to the unit bypassing the process altogether or halting operations, neither of which serves the organization. Rewriting the standard to exclude legacy systems weakens protection across all such systems permanently to solve one temporary problem, without analyzing the broader risk. Exam caveat: the information security manager advises on risk but does not personally accept it. Operational check: confirm the exception is in the register with approver, compensating controls and expiry date, and that it is reviewed before expiry.