Prior to requesting an exception, the submitter or submitting organization is responsible to evaluate and correct the compliance issue when possible. If it is determined that the issue cannot be easily or quickly corrected, an exception can be requested. It is the responsibility of the non-compliant business unit or department to initiate an Exception Request.
IT Exceptions are not automatically approved or granted upon submission. An IT Exception may go through several levels of review in order for ISO to make an adequate assessment of the risk the deviation may present to our environment and data.
Depending on the level of risk assessed by ISO, IT Exceptions may require additional reviews by IT and Business Unit Management before a final decision is made.
Final determination and approval is dependent upon a variety of aspects, the type of data and the overall security risk. The exception process is in place to document deviations from Monsanto Policies and Standards as well as to identify any associated risk and mitigating controls.
PLEASE NOTE: Leadership of the non-compliant organization must be aware of and supportive of any requested exception. Exceptions requested will require a Leadership sponsor