Security Exceptions & Waivers
Security exceptions are controlled, time-bounded risk decisions rather than permanent waivers.
Waiver Rules
- Formal Documentation: Explicit scope, technical justification, mitigating controls, and risk owner.
- Time-Bounded Expiration: Maximum 90-day expiration window requiring formal renewal reviews.
- No Silent Suppressions: Security gates must not silently ignore failures without documented waivers.