Free Engineering Workbench calculator — live below, no login
Policy exceptions and risk acceptances
Track open exceptions to policy and whether they are controlled and current.
Governance, risk & complianceHow it's worked out
- Shares are of open exceptions
- Each exception has an owner, end point and authority
NoteExceptions should expire. A growing pile of expired exceptions is a hidden policy change.
Source: ISO/IEC 27001 clause 6.1.3; ISO 31000
Need help acting on this number?
VVnT SeQuor's ISO & Compliance Implementation practice helps teams turn this metric into a plan.