{"id":"GRD-020","section":"Runtime Guardrails","requirement":"Scope exceptions to a single detection for a defined group","acceptance":"Grant an exception for one detection, data class or tool to one group, leaving every other protection in place for that group. For example, a deal team can discuss financial projections without losing credential or personal-data protection. Document a named owner, business rationale and review date for each exception.","tier":"Tier-independent","whyItMatters":"A team that needs latitude on one data type should not lose every other protection.","verificationMethod":"LT","verificationTest":"One detection is relaxed for a pilot group while all other detections still fire for that group. Show the documented exception owner, business rationale and review date.","formerly":"POL-009","alsoIn":[],"sort":30,"adoptionContext":"Exceptions apply wherever the group works, so a scoped exception should behave the same across every listed context.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"A narrowly scoped exception records a specific deviation and keeps least privilege in place for everything else. The exception still needs an owner, a rationale and a review date.\nISO/IEC 27001: The exception record supports Cl. 6.1.3 only when linked to risk assessment, the risk owner’s approval of the treatment plan and acceptance of residual risk. A named owner, business rationale and review date alone do not establish those decisions.","kind":"framework","references":{"csf":["ID.RA-07","PR.AA-05"],"soc2":["CC6.3","CC5.3"],"iso27001":["A.5.15","Cl. 6.1.3"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Granular exceptions keep the risk-management process transparent about exactly which control is relaxed and for whom. The rationale for each exception must still be documented.","kind":"framework","references":{"rmf":["GOVERN 1.4"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-020","frameworkRefs":{"ISO27001":["A.5.15","Cl. 6.1.3"],"NIST-CSF":["ID.RA-07","PR.AA-05"],"NIST-AI-RMF":["GOVERN 1.4"],"SOC2":["CC6.3","CC5.3"]}}