Security Exception Management Policy

Objective

The purpose of this policy is to define the way in which FundApps raises, approves, records and reviews exceptions to its information security policies.

Scope

This policy applies to all exceptions to FundApps' security policies.

Policy

Raising Exceptions

All exceptions must be raised to the Head of Information Security, the CTO, or the CEO and approved before the event. Ensure that items are recorded appropriately in either the Security Exception Log or the Incident Log.

Approving Exceptions

Exceptions must be approved by the Head of Information Security, the CTO or the CEO.

Recording Exceptions

Reviewing Exceptions

Exceptions will be reviewed by the Head of Information Security annually.