Which statement defines a policy exception?

• A. A formal process to create a new policy.
• B. A documented deviation from policy with justification and approval, tracked and reviewed.
• C. A mandatory security requirement for all personnel.
• D. An exception that bypasses all controls.

Answer: (B)

A policy exception is a formally documented deviation from an established policy, with a clear justification and the necessary approvals, and it is tracked and periodically reviewed. This ensures accountability and ongoing risk management when rules can’t be followed as written.

It’s not about creating a new policy, not about a mandatory requirement, and not about bypassing all controls. Rather, it acknowledges that sometimes a specific constraint or circumstance requires an approved, time-bound deviation, often with compensating controls and oversight, which is why tracking and review are essential.