SECURITY EXCEPTIONS
A security exception is a Decision, not a quiet waiver.
A security exception asks whether a named system may deviate from a named control for a named period. That is not the same Decision as accepting residual vulnerability risk until the next patch window.
Argumont supports security analysis and decision-making. It does not guarantee security or replace qualified professional judgment where required.
Typical Decision
Approve the exception, deny it, time-box it, or require a compensating control first. The owner is often a CISO or control owner. The requester, the service owner, and audit review the deviation.
The card has to name the policy being waived, the system, the expiry, and who will review it. An exception that never expires is just a new policy nobody wrote down.
How this differs from Security Risk Acceptance
Risk acceptance records leftover exposure after a control Decision. A security exception records permission to deviate from a rule. Both can exist on one system. They are not interchangeable pages.
How the method applies
Champion can defend the exception. Challenger attacks an open-ended waiver. Red Teamer tries to use the exception as a path around the control. Inspector will not treat a ticket comment as policy. Judge can refuse a strong winner when expiry is missing.
What the record keeps
The Human Decision has to say approve, deny, or time-box, against which Verdict version, and when the exception expires.
Champion and Challenger test the case, Inspector checks the evidence, and Judge records the Verdict for the Decision Owner.
Example exception Decision
Waive MFA on a break-glass account for 30 days, require a hardware key, or deny the launch. If the Verdict favors deny and the owner time-boxes the waiver, write the expiry and who reviews it. A ticket that aged out is not approval.
Bring Argumont a Decision worth challenging.
Structure the question, test the evidence and the assumptions, and preserve what your organization ultimately decides.
Record a security exception