University of Minnesota  Procedure

Requesting an Exception to the Information Security Policy


Community members must work with their unit IT Director or Department Head to submit an exception if their unit does not comply with a required control(s) in the Information Security standards.


Units can request an exception for up to 12 months.

To obtain an exception an IT Director, IT Service Owner or Department Head must:

  • initiate the online exception process,
  • ensure compensating controls are implemented,
  • request a new exception after the current exception expires, if necessary.