Who may sign off an exception for a High or Medium risk with no reasonable treatment?
- CTO
… In this case, an exception should be sought. Exceptions can only be signed off by the CTO.
– Security risk management process - risk committee
Exceptions must have the signoff from the risk committee on an individual basis.
– Information Security Risk Management Policy
The process page and the policy page name different people who can sign off a risk exception.









