Request and approve exceptions

An exception records that your organization has decided not to meet one control, why, and until when. Once someone other than the requester approves it, the endpoints it covers show Excepted for that control instead of Gap. Use an exception when a control cannot or should not be met on some endpoints and you have a compensating measure or an accepted risk to point an auditor at.

Before you begin

• Requesting an exception needs only compliance:read. Approving and revoking need compliance:manage, which the Owner and Support Manager roles hold.
• Approval takes two people. The person who requested an exception cannot approve it.
• Every exception expires, at most a year after it is requested. When it expires, the finding is live again.
• An exception changes what the compliance pages report. It does not change what is enforced on the endpoint. A framework floor still applies.
• Exceptions are never deleted. Revoked and expired ones stay in the register as part of the record.

Request an exception

You request an exception from the control it covers, so the framework and the setting come from the finding.

1. Select Compliance > Overview, then the framework, then the control. See Review compliance posture.
2. Select Request exception. The Request an exception dialog opens with the framework and setting filled in. They cannot be changed.
3. In Scope, choose what the exception covers:
   • tenant covers every endpoint of this client. On Home Lab, Essentials, and Enterprise, that is your whole organization.
   • site, device_group, or endpoint covers one site, device group, or endpoint. Enter its ID in Scope id.
4. In Justification, enter why the control is not met and what compensates for it. This is what an auditor reads.
5. In Expires, choose a date. It can be today, and at most a year from today. The exception lasts to the end of that day, UTC.
6. Select Request exception.

The console confirms with Exception requested. It suppresses nothing until somebody else approves it. The request is recorded in the audit log.

Approve or revoke an exception

1. Select Compliance > Exceptions. The page opens on the In force view.
2. Choose the Waiting for approval view to see requests.
3. Read the Justification, Scope, and Expires columns.
4. Select Approve. If the button is unavailable, the reason is shown under it. For example, you requested this exception yourself.

The console confirms with Approved the exception on the setting key, and the date until which it suppresses the finding.

To withdraw an exception before it expires, select Revoke on its row. The finding is live again at once. Every approval and revocation is recorded in the audit log with the person who made it.

Views

View	Shows
In force	Active exceptions, soonest to expire first. The default.
Waiting for approval	Pending requests, oldest first. A pending exception suppresses nothing.
Lapsed	Exceptions that reached their expiry date.
Withdrawn	Exceptions someone revoked.
Every decision ever recorded	The whole register.

You can also filter by Status, Framework, Scope, and Setting key, and search the justification and setting key.

Statuses

Status	Meaning
Pending approval	Requested, not yet approved. The finding still counts.
Active	Approved and not expired. Covered endpoints show Excepted.
Expired	Past its expiry date. The finding counts again.
Revoked	Withdrawn by someone before it expired.

An exception’s status changes to Expired the moment its date passes.

Verify

Open the control the exception covers. Endpoints in its scope show Excepted with See the exception. The framework’s percentage leaves excepted verdicts out of both halves, and the Excepted count increases. An exception never turns a gap into Compliant.

If something goes wrong

Symptom	Cause	Fix
An exception has to be approved by somebody other than the operator who requested it.	You requested it.	Ask another person with compliance:manage to approve it.
Deciding on compliance findings needs the compliance:manage permission, which your account does not have.	Your role does not include compliance:manage.	Ask an owner or Support Manager to approve it.
The expiry date cannot be more than a year away, so that every exception is reviewed at least annually.	The date is more than a year out.	Choose an earlier date, and request a new exception when it lapses.
A scope id is required for this scope type. Without one the exception would cover the whole fleet.	You chose site, device_group, or endpoint without an ID.	Enter the ID, or choose tenant.

Next steps

• Generate evidence packs. Each pack lists the exceptions in force or decided during its period, with justification, requester, approver, and dates.
• Review compliance posture