08/17/2026
An approved exception still needs to be managed.
Record the reason, accountable owner, compensating control, and review date instead of relying on memory or an old email thread.
A practical next step: Create one list for current technology and security exceptions, then remove anything nobody can explain.
Which exception has quietly become permanent?