Exempt flag

[jaikellaila]

Hello,

Does the exempt flag make the control as 'not applicable'? or it only skips the attest state?

To give more context, I would like to make some controls as 'not applicable' without using the policy exception workflow. So i'm looking for an easier way to tag those not applicable controls without going through a workflow.

Thank you

[SanjivMeher]

Here is a nice thread to understand the exempt flag.

https://www.servicenow.com/community/grc-forum/use-of-exempt-flag-in-control/m-p/1286364/page/3

I had the same question few years back. So when there is an exception created, your control would automatically set as exempted. Which means, you control remains compliant and it also doesnt generate an attestation until the exception is closed.