Re: Security policy exceptions template?

In-Reply-To: <5383591.1098970428472.SLOX.WebMail.wwwrun@mail.synaxis.org>

I think the issue in your organisation lies in your second-to-last  paragraph: 
"the question is how to approve and document exceptions to the policy" and I 
have to ask you, how did you gain approval for the policy itself - and from 
whom?

Although I fear that it may not be the answer, I'm hoping that you would be 
able to say, "From the Executive Committee" and then I'd be able to say, "Well 
my friend, you have your Executive Committee appoint someone to act on their 
behalf to review requests for policy exceptions and to make recommendations to 
the Executive Committee on whether or not to grant them."

Absenting all that, (and here I'm assuming something else entirely - that you 
got your policy as a sop to make you be quiet and go away and that there is 
little management interest in an actual, effective information security 
program) then here's a suggestion (well, two, actually): Send out an 
all-company email telling everyone that exceptions to policy must be approved 
by an XXX-level manager and that the XXX-level manager must maintain the 
following documentation on the exception and review it at least annually 
(naturally, you will also append the documentation). If that sounds like career 
suicide, here's my second suggestion - similar to the first. You send out the 
all-company email but you say that YOU must approve all etc., etc., etc. and 
then you embark on a campaign to educate your management on what a risk this 
non-separation or duties represents for your company.

Hope this helps.

John A Blackley