SFS D / SF 9

Back to SFS D

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence been maintained throughout the review period confirming that all approved security policy exceptions explicitly specify duration, compensating controls, and scheduled review dates?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented exceptions contain all required elements

Assessment criterion and evidence

Actor: organization management. Scope: security policy exceptions requiring formal approval. Evidence period: review period. Required evidence: Formally approved exception records; Specified duration periods; Documented compensating controls; Scheduled review dates. Negative criterion: Exceptions lack required elements or documentation. Missing evidence: Pending verification when no evidence exists

View the JSON record (opens in a new tab).

Assessment result: unset.