The University of Texas at San Antonio

Office of Information Technology

Office of Information Security (OIS) Standards


OIS 29 – Standard for Policy Exception and Risk Assumption



While it is the intent of the Office of Information Technology that policies and procedures be adopted by the owners and stewards of information technology resources, there may be occasional exceptions to the application of policy due to technical, operational or administrative issues. In such cases the exception must be registered, the risk must be evaluated and documented, and formal approval must be obtained. The department requesting the exception will assume the risk(s) resulting from the exception.



This standard supports HOP Policy 8-12 Information Resources Use and Security Policy



This standard applies to all UTSA faculty, staff, and students.



If you have any questions about OIS 29 – Standard for Policy Exception and Risk Assumption contact the following office:


The Office of Information Security



  1. Exception Process
    1. The department requesting the exception must provide the following:
      1. Identification of the applicable policy
      2. Description of the requested exception
      3. The date the exception will start and end
      4. Reason why the policy cannot, or should not, apply
      5. Description of the system impacted and the level of confidentiality of the data impacted
      6. Description of other risks that might occur
      7. Description of how the system will be monitored and compensating controls that will be established.
2. Requests for exceptions will be submitted to the Information Security Officer electronically by the head or chairman of the responsible department, after consultation with the technical representative for that department or unit. If the exception is denied, the issue may be escalated to the Vice Provost for Information Technology and CIO.



Effective Date: January 10, 2012

Last Revised: July 8, 2014