GRC Oversight

Live demoFictional sample data. Nothing is saved.

Sign up
Northwind Robotics

16Compliance

Exceptions

Time-boxed control and policy waivers with expiry-driven review. New exceptions start in DRAFT; an admin approves with a mandatory expiry, and the expiry job flips it to EXPIRED and opens a finding automatically when it passes.

Exceptions (3)

  • EXC-0001

    MFA waiver for legacy build server

    APPROVED

    Scope: CONTROL · CC6.1

    Build server predates SSO rollout and cannot be migrated until Q4. Network-isolated with IP allowlist in the interim.

    Compensating controls: IP allowlist + VPN-only access, reviewed weekly by platform team.

    Approved: 2026-05-01 · Expires: 2026-08-01

  • EXC-0002

    Vendor SOC 2 bridge letter pending

    DRAFT

    Scope: RISK · Vendor SOC 2 bridge letter missing

    Key subprocessor's annual SOC 2 report lapsed while the new one is in fieldwork.

    Approved: — · Expires: —

  • EXC-0003

    Disk encryption exception — kiosk devices

    EXPIRED

    Scope: POLICY · Endpoint Security Policy

    Two shared kiosk devices in the SF office run a locked-down OS image without FDE support.

    Compensating controls: Devices are bolted down, on a segmented VLAN, and auto-wipe nightly.

    Approved: 2026-01-10 · Expires: 2026-04-10