+Exceptions from Existing Policies and Instructions

Exceptions from Existing Policies and Instructions

Exceptions to the policies and instructions for information security as well as respective controls go through the OIS-06 risk management process, including approval of these exceptions and acceptance of the associated risks by the risk owners. The approvals of exceptions are documented, limited in time and are reviewed for appropriateness at least annually by the risk owners.
Additonal Criteria-
Supplementary Information - About the CriteriaAbout the CriterionExceptions in the sense of the basic criterion can have organisational or technical causes, such as
• An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud customer; and
• A system component lacks technical properties to configure it according to the applicable requirements.
Cloud customers can use appropriate controls to ensure that they obtain information from the Cloud Service Provider about deviations from information security policies and instructions in order to assess and appropriately manage the associated risks to their own information security.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer