What is a policy exception?
A policy exception is an approved, documented departure from a security policy, for example a system that cannot meet a standard yet. A formal exception process records the reason, the risk, compensating controls, the approver, and an expiry date. It prevents quiet, permanent workarounds.
What the buyer is really asking
Every company makes exceptions to its policies. Buyers want to see them approved, recorded, and set to expire. Describe who approves exceptions and how long they last.
Other ways buyers ask it
Every one of these wants the same answer:
- “Do you have a formal policy exception process?”
- “How are exceptions to security policy approved?”
- “Do policy exceptions expire?”
Evidence to have ready
- The exception procedure
- An exception log with approvals and expiry dates
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.