Exceptions & Compensating Controls

EXCEPTIONS & COMPENSATING CONTROLS

Security exceptions and waivers are granted and forgotten, so expired ones sit live and the strength of the compensating controls behind them is never revisited. Risk accumulates in the gaps.

Actors

  • CISO
  • Head of Security Governance
  • Risk Owners

Systems / Vendors

  • GRC platform
  • Risk register
  • SIEM

Business Question

"Which of our risk exceptions have expired, and are the compensating controls behind them actually holding?"

What SPoG Does

  • Tracks expired and expiring exceptions and highest-risk waivers.
  • Assesses the strength of compensating controls.
  • Keeps exception risk visible and time-bound.

Outcome Metrics

−40%

Expired exceptions live

1

Live exception register

6–10 wks

To first outcomes

Contact us to learn more →