Chapter 4 — Exceptions with compensating controls
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 What an exception is"]
N2["4.2 Compensating controls"]
N3["Lab — Exception register review"]
N4["4.3 Reading the review"]
N5["4.4 Accountability"]
N6["Why allowlisting fits these machines"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 What an exception is"]
N2["4.2 Compensating controls"]
N3["Lab — Exception register review"]
N4["4.3 Reading the review"]
N5["4.4 Accountability"]
N6["Why allowlisting fits these machines"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 What an exception is]
|
v
[4.2 Compensating controls]
|
v
[Lab — Exception register review]
|
v
[4.3 Reading the review]
|
v
[4.4 Accountability]
|
v
[Why allowlisting fits these machines]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) design an exception register; (2) choose compensating controls; (3) review expiry.
4.1 What an exception is
Some machines cannot be upgraded this year. An exception records that the risk is knowingly accepted for a period, by whom, and with which compensating controls. It is not permission forever; each entry has an expiry date. At Kestrel, each entry names the machine, the reason it cannot be upgraded, the controls in place, the manager who accepted the risk and the date the decision expires. An exception without these details is only a note that a problem exists. Expiry forces a fresh decision, so a temporary arrangement cannot quietly become permanent. Priya builds the register as a simple table, so clinic managers can read it without technical help.
4.2 Compensating controls
For an imaging PC that cannot be patched, Kestrel reduces exposure: place it on an isolated network segment that reaches only the image server, block internet access, remove email and web browsing, apply application allowlisting and restrict who can sign in. The CIS Benchmarks and Microsoft's App Control guidance give the configuration detail. Each control reduces a different path: the segment limits which machines can reach the PC, blocking the internet and email removes common ways malware arrives, allowlisting stops unapproved programs running, and sign-in restrictions limit who can make changes. Priya records which controls are in place on each excepted machine, with evidence such as a firewall rule.
Lab — Exception register review
"""Review a synthetic exception register: expired entries and missing compensating controls (stdlib only)."""
import datetime as dt
today = dt.date(2026, 3, 1)
reg = [("IMG-N1", "2026-06-30", "isolated VLAN"), ("IMG-N2", "2026-02-15", "isolated VLAN"),
("IMG-H1", "2026-05-31", ""), ("IMG-H2", "2026-01-31", "isolated VLAN"),
("CEPH-M1", "2026-09-30", "isolated VLAN"), ("IMG-Q1", "2026-04-30", "no internet")]
exp = [d for d, e, _ in reg if dt.date.fromisoformat(e) < today]
nocc = [d for d, _, c in reg if not c]
print(f"entries {len(reg)}; expired {len(exp)} {exp}; no compensating control {len(nocc)} {nocc}")
Run with python3 lab_exceptions.py. Verified output:
entries 6; expired 2 ['IMG-N2', 'IMG-H2']; no compensating control 1 ['IMG-H1']
4.3 Reading the review
Of six entries, two have expired without renewal and one has no compensating control recorded. Priya raises all three with the operations manager the same week. The expired ones are either renewed with a fresh decision or scheduled for replacement; the missing control is fixed by moving the machine onto the isolated segment. The review shows why a register needs checking, not just filling in: entries had expired without anyone noticing, and one control existed only on paper. Priya adds the review to the quarterly schedule so that expiry dates and controls are checked regularly.
4.4 Accountability
Each exception is approved by a named manager, not the IT supplier, because accepting risk is a business decision. Approvals are reviewed quarterly. The supplier can advise on controls and costs, but it does not carry the consequences of a failed clinic or a data breach; Kestrel does. Naming the manager makes the decision visible and gives auditors a person to ask. At the quarterly review, each approver confirms that the reason still holds and the controls are still in place, or the machine moves to the replacement plan. Priya records each confirmation with the date and the approver's name.
Why allowlisting fits these machines
Imaging PCs run a small, stable set of programs: the capture software, its database client and a viewer. That makes application allowlisting practical, because the list of permitted software is short and rarely changes. Anything not on the list simply does not start, which protects a machine that can no longer receive operating system patches. On a general office desktop, where staff install many tools, allowlisting is much harder to maintain. Priya uses audit mode for two weeks first, collecting what actually runs, so the enforced list does not block a forgotten helper program such as the vendor's licence checker. Publisher-based rules are preferred to file-path rules, since vendor updates then keep working.
Worked example
IMG-H1 lacks a recorded control; the fix moves it to the isolated segment, then the entry is updated with the date and evidence.
Synthetic case. The register entries are synthetic.
Errors and limits
Exceptions without expiry silently become permanent; the quarterly review exists to catch that.
Exercises
- EX016 — Register fields. List five fields an exception entry needs. Rubric: 3 = device, reason, owner, controls, expiry;; 2 = four;; 1 = fewer;; 0 = none.
- EX017 — Isolation design. Describe the network access an isolated imaging PC should have. Rubric: 3 = only to the image server, no internet;; 2 = restricted but vague;; 1 = vague;; 0 = none.
- EX018 — Who approves. Why should a manager rather than the supplier approve exceptions? Rubric: 3 = business owns risk acceptance;; 2 = vague;; 1 = minimal attempt;; 0 = none.
- EX019 — Expired entries. What should happen to an expired exception? Rubric: 3 = renewed by a new decision or the device replaced;; 2 = one option;; 1 = ignore;; 0 = none.
- EX020 — Lab reading. What did the review find? Rubric: 3 = two expired and one missing control, named;; 2 = counts only;; 1 = wrong;; 0 = none.
Synthesis
A small, reviewed register keeps unavoidable risks visible and limited.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →