SFS D / SF A

Back to SFS D

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence been maintained throughout the review period confirming that personnel authorized to approve security policy exceptions are formally reviewed and reaffirmed at defined intervals?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence showing periodic reviews (e.g., quarterly) of exception approver roles confirming current authorization status and completeness of assignments

Assessment criterion and evidence

Actor: Organization management. Scope: Security policy exception authorization roles. Evidence period: Review period. Required evidence: Records of review meetings confirming authorization status; Updated authorization lists with review dates and responsible parties. Negative criterion: No evidence of required periodic reviews, or reviews conducted without verification of maintained authorization appropriateness. Missing evidence: Pending until documented evidence of review activities is provided

View the JSON record (opens in a new tab).

Assessment result: unset.