A business unit has requested an exception to the organization's new access control policy. Which of the following is the BEST way for the information security manager to address this issue?

The correct answer is C. Submit the exception for review. The best way for the information security manager to address a business unit's request for an exception to the access control policy is to submit the exception for review. This ensures that the request is evaluated according to the organization's risk management framework and…

Submitted by haru.x· Apr 18, 2026Information Security Governance

Question

Options

ARewrite the security policy for the exception.
BDisable the resources that require an exception.
CSubmit the exception for review.
DDeny the exception to the security policy.

How the community answered

(24 responses)

A
4% (1)
B
13% (3)
C
75% (18)
D
8% (2)

Explanation

The best way for the information security manager to address a business unit's request for an exception to the access control policy is to submit the exception for review. This ensures that the request is evaluated according to the organization's risk management framework and that all stakeholders, including senior management, are involved in the decision-making process.

Topics

#Policy exception management#Information security governance#Policy review process#Access control policy

Community Discussion

No community discussion yet for this question.

Full CISM Practice