Somewhere in your clinic’s shared drive sits a security exception form waiting for a signature. Signing it feels routine — one machine, one setting, one sensible reason — and most of the time it is. But exceptions are where security programmes quietly go soft, because nobody remembers a loan until it is six months overdue. The Ops Atlas, whose SecOps definition we lean on throughout this site’s management guides, treats exceptions as governed debts: owned, dated, reviewed, and counted. So before the next form reaches your desk, here are the eight checks worth making — conversationally put, but each one traceable to the working contract the Atlas describes.
First, what an exception actually is in SecOps terms
A quick frame before the checklist. The contract between security and operations standardises configurations through hardening baselines; an exception is a documented, temporary deviation from the baseline. It is a permit, not a pardon. The Atlas’s September worked example dedicates a metric to exactly these: when September’s numbers were cut, 6 of the 35 approved exceptions were overdue for review — seventeen percent of the whole book. That figure, printed monthly, is what keeps a friendly arrangement from becoming a hole with paperwork attached. Keep it in mind as you read the eight checks, because each one exists to prevent your signature from joining that seventeen percent without your noticing.
The eight checks before your signature
1. Who owns this exception, by name?
Not “IT”, not “the vendor”, not “whoever handles it”. A person, employed, reachable, and aware they are named. An exception without an owner behaves exactly like the Atlas’s unowned findings — 18 of 600 in the worked example, a number the contract counts weekly because nobody chases a ghost. Titles change and inboxes expire; a name with a face survives both, which is why the register asks for the person, not the role.
2. What is the written reason?
“Legacy” is not a reason; it is an alibi. A real reason names the constraint: the leased imager that cannot take the setting, the licensing dongle that breaks, the clinical device certified only on an older configuration. If the reason cannot survive being read aloud at a budget meeting, it is not a reason yet.
3. When does it expire?
Every exception carries an expiry date, full stop. Renewal is allowed; infinity is not. The habit mirrors the aftercare schedule that governs recovery after non-surgical rhinoplasty — reviewed on dates, not on vibes, because healing and risk both drift while nobody is looking.
4. Is it in the shared register, or in someone’s inbox?
The contract runs on one shared register — the single place both sides read. An exception recorded in an email thread is a rumour with attachments. If it is not in the register, it does not exist, no matter how sincere the approval chain.
5. What compensating telemetry covers the gap?
If a machine opts out of a hardening setting, the watchers lose a signal. Ask what replaces it: extra logging, closer review, a tighter network position — something specific, written on the form, not “we’ll keep an eye on it”. The CIS Control 8 duties owed the monitoring function — logging basics at IG1, central collection and ninety-day retention at IG2 — do not pause because one device is special. An exception with no compensating telemetry is not a lower risk; it is the same risk, wearing a blindfold.
6. Who can revoke it, and how fast?
Every permit needs a revocation path and a named hand on it. One caution from the Atlas belongs here: whoever edits the routing rules and registers holds power closer to domain admin than anyone admits, so the revocation right should sit with someone who does not also control the record-keeping. Separation of duties, politely enforced.
7. Has this exception been renewed before?
First renewal is a process; third renewal is a decision. The Atlas’s teaching case is the Netlogon campaign Microsoft ran against CVE-2020-1472, in which the allow-list of grandfathered machines had to reach empty ahead of irreversible enforcement on 9 February 2021 — the cleanest proof on record that an exception list can be driven to zero when someone owns the driving. Renewal three, in that light, is not a signature; it is a fork in the road.
8. Did you count the book this month?
The final check is not on the form at all. Whoever signs exceptions should also see the monthly count: total exceptions, overdue count, oldest overdue, and who holds each. Seventeen percent past review — the worked example’s figure — is the sound of a book nobody is reading. Reading it monthly is the whole discipline, and it costs less time than the clinic spends ordering coffee for one meeting.
Three SecOps pushbacks, answered in advance
Every committee that adopts these checks hears the same three objections, so they may as well be answered here. “Exceptions are just how healthcare works.” Partly true — clinical devices carry real constraints, which is precisely why the permit exists and why the reason must be written. The checks do not reduce the number of exceptions; they reduce the number of forgotten ones, and those are different populations. “The register is bureaucracy.” The register is a list with dates on it, maintained in minutes per week; the alternative is reconstructing approvals from email after an incident, which is bureaucracy with better lighting. And “we will review things when the quarter calms down” is the sentence every overdue exception in that seventeen percent was born under. Calm quarters arrive on nobody’s calendar, which is why the review dates live on the shared one instead.
A one-paragraph recap for busy committees
The eight checks compress to a short card:
- Named owner, written reason, hard expiry.
- One shared register, no side records.
- Compensating telemetry, named revoker.
- Renewals questioned, totals counted monthly.
That card is the exception chapter of the working contract in miniature; the full text, with its baselines, queues, and joint metrics, is at the Atlas’s SecOps page. Clinics already run this exact logic wherever safety and appearance both matter — the same instinct that structures safe chemical peel and laser care guidelines, or that sets review points inside scar removal and treatment options. Permits get conditions, reviews get dates, and the book gets counted. Sign the form after the eight checks and the exception stays what it should be: a small, governed, temporary debt — not a permanent guest.