The University of Texas at San Antonio
Office of Information Technology
Office of Information Security (OIS) Standards
OIS 29 – Standard for Policy Exception and Risk Mitigation
I. STANDARD STATEMENT
While it is the intent of the Office of Information Technology that policies and procedures be adopted by the owners and stewards of information technology resources, there may be occasional exceptions to the application of policy due to technical, operational or administrative issues. In such cases the exception must be registered, the risk must be evaluated, mitigated, and documented, and then formal approval must be obtained. The department requesting the exception must manage the risk(s) resulting from the exception.
II. RATIONALE
This standard supports HOP Policy 8-12 Information Resources Use and Security Policy
III. SCOPE
This standard applies to all UTSA faculty, staff, and students.
IV. CONTACTS
If you have any questions about OIS 29 – Standard for Policy Exception and Risk Mitigation contact the following office:
The Office of Information Security
V. PROCEDURES
- Exception Process
- The department requesting the exception must provide the following:
- Identification of the applicable policy
- Description of the requested exception
- The date the exception will start and end
- Reason why the policy cannot, or should not, apply
- Description of the system impacted and the level of confidentiality of the data impacted
- Description of other risks that might occur
- Description of how the system will be monitored and the compensating controls that will be established.
- The department requesting the exception must provide the following:
- Requests for exceptions will be submitted to the Information Security Officer electronically by the head or chairperson of the responsible department, after consultation with the technical representative for that department or unit. If the exception is denied, the issue may be escalated to the Vice Provost for Information Technology and CIO. If denied, the issue may be escalated to the Vice Provost for Information Technology and CIO.
______________________________________________________________________________
Effective Date: January 10, 2012
Last Revised: Apr 27, 2020