University of Minnesota  Procedure

Requesting an Exception to the Information Security Policy


Expand all


Table of Contents

TOC placeholder


Please use the contact section in the governing policy.


Community members must work with Departmental or Central University Office of Information Technology to submit an exception if their unit does not comply with a required control(s) in the Information Security standards. 


Units can request an exception for up to 12 months, provided an appropriate remediation plan and timeframe are included. 

To obtain an exception an IT Director, IT Service Owner or Department Head is responsible for the following: 

  • Initiate the online exception process.
  • Ensure compensating controls are implemented.
  • Define a remediation plan.
  • Notify University Information Security ([email protected]) when the exception is resolved. 
  • Request a new exception before the current exception expires, if necessary.