Timeline for How to ask boss for written authorization to violate a strict company policy?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 10, 2017 at 19:04 | comment | added | jpmc26 | @JMK You could potentially put the request through normal IT channels, or submit it to whoever is responsible for writing/enforcing the policy. | |
| Sep 10, 2017 at 17:49 | comment | added | James Hollis | @BenCrowell I don't think it's supposed to be a CYA, I think the idea is that the request is explicitly denied and the manager must either convince them or give up. Higher ups see things differently, and won't want you to do something really dumb just to meet a deadline or quota, as middle managers often do. | |
| Sep 10, 2017 at 13:43 | comment | added | Douglas Held | Well, the question says the relevant policy "is for security" so I expect, there is a security responsible person at the asker's org. who wrote the policy. @lxrec, the exception process is not typically something security people would want to advertise widely. I would agree if they were requested on a regular basis something would be wrong. But for occasional requirements, I disagree. It is perfectly normal to allow and monitor exceptions. | |
| Sep 10, 2017 at 13:34 | comment | added | Ixrec | My company has a security team, but I've never heard of a standardized "Security Policy Exception" form for people to fill out. To me the idea of even having such a standardized process for this seems like a giant red flag that the policy is too restrictive. | |
| Sep 9, 2017 at 12:36 | comment | added | user14026 | This would be more appropriate if the OP thought this action was a good idea. Since the OP thinks it's a bad idea, this is at best a creative CYA. | |
| Sep 8, 2017 at 22:41 | comment | added | Anthony | As a fellow ItSec professional, your views match my own. +1 I was just about to post my own answer, but you have said what I was going to say better. If the business case is sufficiently persuasive, such exception may be granted | |
| Sep 8, 2017 at 17:36 | comment | added | Joshua | @Dan: Engineering has largely been able to force-create the exemption here after Anti-Virus broke the build one too many times. Years later we were able to find one that didn't break the build. | |
| Sep 8, 2017 at 11:31 | comment | added | JMK | Not every company has a security team, actually they are pretty rare in my experience | |
| Sep 8, 2017 at 6:48 | comment | added | Dan | Your example is giving me heart palpitations! | |
| Sep 8, 2017 at 1:06 | review | First posts | |||
| Sep 8, 2017 at 3:20 | |||||
| Sep 8, 2017 at 1:05 | history | answered | Douglas Held | CC BY-SA 3.0 |