Question

A business unit at a financial services firm needs to deploy a legacy application that cannot support the company's mandatory 15-character password standard; the vendor confirms the platform is limited to 8 characters and will not be updated for 18 months. The business unit wants to proceed to meet a regulatory reporting deadline. As the security governance lead, what is the MOST appropriate way to handle this deviation from the established standard?

Accepted Answer

Document a formal policy exception with a defined scope, compensating controls, risk owner sign-off, and a time-bound expiration tied to the 18-month remediation window

Answer

Permanently update the enterprise password standard to an 8-character minimum so the application remains compliant with internal policy

Answer

Deny the deployment outright because it violates the mandatory standard, regardless of the regulatory deadline

Answer

Allow the deployment informally and revisit the configuration during the next annual policy review cycle