Recording an exception: with a reason and an end date

Example

At Bakkerij De Testoven the engineers install software themselves. One part of a control therefore does not fit them. The owner records that the control does not apply to the group "Engineers" for that one part, until next year. Instead, the team lead checks every week what was installed.

How to record an exception

An exception is a line on the control, and it always applies to a group, so make the group first (see Making groups). Then open the control, for example from Audit. Under What applies per security group, click Change the lines, then Add a line.

1. Pick the part at the top: Whole measure, or one Evidence question. Keep it as narrow as you can: with one part, the rest of the control still applies to the group.
2. Under Security groups for this line, tick the group, for example Engineers.
3. Tick Does not apply to this group.
4. Why does the measure not apply to this group? Required. The auditor reads this reason.
5. Does not apply until (then the measure applies again): 12 months by default. You pick a day from tomorrow up to 3 years ahead. After that the group counts again.
6. Click Save lines.

The first line that fits a group applies, and Everything else is always last. A line can be moved up or down. A control with no lines applies to every security group.

Does the group sit Outside NIS2, on IT environment, Size? Then you need no line: nothing in it is assessed or checked anywhere. Use a line only when the group stays in scope for the rest.

Excepted is grey, never green

If you take a group out of the whole control, the Applies to line shows the group as Excepted, in grey, with the reason and the end date. Excepted does not count, but it is not in order either.

If the exception covers one part, as at De Testoven, that part gets a line of its own: a number, "for" and the name of the part. For the other parts the group still counts.

So an exception never turns a control green. The rest of the scope still has to be in order. If an exception takes out everything, the control stays grey.

Change the end date, or remove it

• The lines on the control show each decision with who made it and when: "does not apply until ...".
• Extend or shorten: click Change the lines, change the date and click Save lines.
• Remove: click Remove line and save. The group counts again at once.

An exception that was recorded earlier, before the lines, stays until it ends. It shows under Recorded earlier: not applicable. You can remove it there. Add new ones as a line on the measure.

An accepted risk suggests an exception

Did you accept a risk in the risk register, for the whole company or for one group? Then the app suggests an exception on the measures that risk is linked to. The app only suggests. Nothing changes until an owner or administrator confirms.

Accepting a risk needs a review date: until when the acceptance holds. The suggestion shows on the measure under Suggestion: an exception because the risk is accepted, and in your to-do list as suggested exceptions because a risk is accepted. The reason comes from the acceptance. Change it if you want; the auditor reads it. Until goes no further than the review date of the risk. Click Confirm exception.

A risk accepted for the whole company suggests the whole measure; a risk accepted for one group suggests that group. Nothing is suggested while a part of the risk is still open on that measure, or while the parts of the risk overlap or cannot be read.

On a CyFun measure the rule is stricter, because CyFun requires the measure. A confirmed row shows as Deviates from the level and does not count as implemented. The measure stays not implemented, and the deviation appears in the statement of applicability with the risk as the reason. Key measures, and at Essential the management-aspect measures, never get a suggestion.

The exception follows the risk. When the risk is re-opened, its review date has passed, or its scope has been narrowed, the exception shows under Review this not-applicable line, on the measure and in your to-do list. Nobody but you removes it, on the control.

Who can do this?

Owners, administrators and members who may manage the register.