Exception Register
Every approved policy exception, its expiry, and its renewal history.
§12.3
CISO
Planned content
- Provision excepted, requestor, approver
- Business justification, compensating controls
- Approval date, expiry date, 90 days maximum
- Renewal chain, each renewal its own dated row
- Status: active, expired, renewed, revoked
A renewal writes a new row. Appendix G tests that exceptions were re-approved rather than silently extended, so editing an expiry date in place would make the finding invisible. The database enforces the 90-day cap.