FiraCode Security Assurance Toolkit · Resource 01

Security Exception Decision Record

A one-page operational record for decisions where a security requirement cannot be met as designed today. It makes the requirement gap, residual exposure, compensating controls, decision authority, review triggers and closure evidence visible in one place.

Free
No email gate
Fillable PDF
Reviewed 2026-09-11

Download fillable PDF Download static PDF

No form, no mailing-list signup and no account required.

When to use it

Make the exception reconstructable six months later.

A requirement cannot be met temporarily and the applicable governance permits an exception or waiver path.
Compensating controls reduce exposure, but residual risk still needs to be made explicit.
The decision needs a named authority, a review or expiry point and objective evidence.
The exception needs a planned end state and closure criteria before temporary becomes permanent.

One-page decision structure

What the record captures.

decision context, system or service and accountable roles
the unmet requirement, affected scope and reason it cannot be met now
risk scenario, residual exposure and compensating controls
evidence, monitoring, remediation owner, target date and planned end state
review triggers, decision outcome, rationale, closure criteria and closure evidence

Governance noteUse this template only where the applicable governance permits an exception or waiver path. An internal record does not override legal, regulatory, contractual, policy or mandatory baseline obligations.

Need this adapted to your workflow?

Document security decisions in a record tailored to your organisation.

FiraCode can adapt the template to your security assessment, risk management or exception approval process.

Discuss an adaptation

Loading the page

We are preparing the requested content.