Policy Exception and Policies

[rajeeshraj]

Hello

1. When a policy exception is created, the Source type can be selected as Policy, and the system forces you to select a policy. I would like to know what happens when a Policy is approved.

2. When the Source type is Control objective, control, or issue, the system forces you to select impacted controls. I believe the Impacted control becomes Exempt when the policy exception is approved. The question here is, should these controls be in the Monitor state to be marked as Exempt?

3. When we are creating Policy Exceptions from an Issue or Policy, are we actually requesting exceptions for the controls associated with this issue and policy respectively?

Thanks

[Community Alums · Accepted solution]

Hi @rajeeshraj ,

1. When you have requested an extension on the policy exception and has been approved by the approver then Approved extensions, Remaining extensions, Date approved, Extension date, Extension reason, Original valid to fields would appear.

Then you can Request an extension and Review the policy exception and extension request

2. The controls should be in Attest,Review or Monitor state.

3. That's correct, with Policy Exceptions from an Issue or Policy, are we actually requesting exceptions for the controls associated with this issue and policy respectively.