Manage policy exceptions and extensions

Policy exceptions and extensions provide temporary relief for non-compliant controls.

The policy exception captures the rationale, comments, and evidence to support the acceptance or rejection of a policy exception request. Also, you can request an extension to an approved policy exception before the policy exception validity period. The control owner, the compliance manager, and the risk manager may be involved in the policy exception and extension workflow.

• Request a policy exception
  Users can request exceptions for policies, control objectives, or issues by specifying the reason of exception on a particular list of the systems, applications, networks, or entities for which the exception will apply. The user must also specify the duration for which the exception is required.
• Request an extension to policy exception
  Request an extension for the policy exception that you created.
• Review the policy exception and extension request
  After reviewing a policy exception request, a compliance manager can accept or reject the request. However, if the compliance manager doesn't have enough information decide, they can request a risk assessment by the risk manager.
• Request a policy exception through Service Portal
  Your employees and business users within your company can request a policy exception through the ServiceNow® Service Portal.
• Request a policy extension through Service Portal
  From the ServiceNow® Portal, anyone who has requested a policy exception can request an extension before the policy deadline.
• Policy Exception Integration with Vulnerability Response
  Starting with Version 10.1, you can request policy exceptions using the GRC policy exception management capability inherent in the Policy and Compliance Management application from within version 10.3 of the Vulnerability Response application.

Parent Topic:Classic UI for Policy and Control Management