Set Exceptions on Controls

Exceptions exclude a control from your compliance score while documenting the reason for your team and auditors. Unlike setting a control out of scope, which hides the control from reports entirely, an exception leaves the control in reports along with your justification.

For the four exception types and the space-level settings that affect approval, read Customize Compliance.

Set an exception on one controlCopy Anchor Link

1. From a space, select Compliance in the side navigation, then select the framework. Scroll to the list of controls.

   

2. Select the control you want to except.

   

3. In the top-right corner, select TAKE ACTION > Set Exception.

   

4. Choose the exception type: Risk Accepted, Workaround, False Positive, or Disable.

5. Choose a Time Limit: a number of custom days, 1 week, 1 month, 3 months, or 6 months, or Indefinitely. (Indefinitely is available only if the space allows non-expiring exceptions.)

6. Optionally, give the exception a name. If you leave it blank, Mondoo generates one.

7. Write a justification. It's required, and reviewers see it.

8. Select SAVE EXCEPTION.

Set an exception on several controls at onceCopy Anchor Link

1. From the framework's controls list, check the boxes beside the controls you want to except. A bar appears at the bottom of the page.

   

2. In that bar, select SET EXCEPTION.

3. Choose the exception type and time limit, then provide one justification that applies to every selected control.

4. Select SAVE EXCEPTION.

Approve or reject an exceptionCopy Anchor Link

An exception's approval flow depends on your space's exception settings. In new spaces, an exception stays pending until a team member with the Owner, Exception Reviewer, or Exception Manager role approves it. If a space owner has turned off Require exception approvals, exceptions apply as soon as they're created. Approving keeps the exception. Rejecting removes it and re-enables the control.

1. From a space, select Compliance in the side navigation, then select the framework.

2. Select the Exceptions tab to see every exception on the framework, then select an exception to open its detail.

   

3. For an exception with a NEEDS REVIEW status, select APPROVE to keep the exception or REJECT to remove it.

   To review several pending exceptions at once, check the boxes beside them on the Exceptions tab and select APPROVE or REJECT in the bar at the bottom of the page.

Re-enable a controlCopy Anchor Link

To remove an approved exception and restore the control to your compliance score:

1. Open the framework's Exceptions tab and select the exception to open its detail.

2. Select the Modify exception (pencil) button, then select Remove exception and enable.

   

3. Confirm the removal.

An exception that's still pending review can be removed by selecting REJECT.