Allow policy exception requests from other applications

Starting with Version 10.1, you can leverage new policy exception capabilities in Policy and Compliance Management from within other applications.

Requests are routed through multiple approvals based on risk rating, policy, and control objective associated with an exception. Compliance and risk teams obtain better visibility with respect to exceptions raised for vulnerabilities.

Note:

Starting with Version 10.1, if you have installed Version 10.3 of the Vulnerability Response application, you can request policy exceptions using the GRC policy exception management capability inherent in the Policy and Compliance Management application. For details, see Policy Exception Integration with Vulnerability Response.

Before allowing other applications to leverage the policy exception capabilities of Policy and Compliance Management, you must first add the application to the Integration Registry and then perform some preliminary setup.

• Configure policy exceptions from other applications
  Before you can request policy exceptions from applications other than Policy and Compliance Management, you must add a UI action for making the request and, optionally, create a new list view to see policy exception target records on the Policy Exception form.
• Register other applications to request policy exceptions
  Enable other applications to request policy exception from any table such as Problem or Incident and so on. The applications must be added and configured in the Integration Registry.
• Define policy exception reason choices
  You can define reason choices to be available to any user who requests an exception.
• Define policy categories
  You can filter policies by specific criteria to limit the number of policies displayed when you are creating policy exceptions.
• Create an exception questionnaire
  When you are setting up the Policy Exception Integration Registry, you can define configurable questions that can be included in risk assessments created from templates. The Policy Exception Integration Registry can be associated with one template at a time.
• Define policy exception verification rules
  The verification rule is used to verify the accuracy and completeness of a policy exception request prior to sending it out for approvals. You can define multiple levels of approvers for an application.
• Define policy exception approval rules
  Approval rules define the criteria (risk rating, policy or control objective) that is used for sending approval requests for an exception. Rules can be configured for an application and you can identify multiple levels of approvers, as needed.
• Define policy extension approval rules
  Enable the GRC Approval Configurator from the Policy and Compliance Properties page to allow multiple approvers for policy extension approvals, replacing the single default approver (Compliance Manager).