About Exceptions

Exceptions are the various documents and forms used to document authorization for access to secured materials and/or authorization to export secured materials. Materials could be data, hardware, software, or other information designated as restricted due to a need for IP Protection or NIS.

Important:
  • The number of IP Security Exceptions in the system directly impacts the performance of operations like 3DSearch. It is recommended to only have exceptions that are used. Promote any IP Security exception not used to the Archived state or delete it, if possible.
  • IP Security Exceptions should only be used as an exception to provide temporary time-bound access, and not as a normal way to provide access. The IP Security Manager should revisit the security rules associated to the class in case exceptions are becoming a regular occurrence.
  • IP Security Exceptions that are past the due date can be archived using Archive Expired Exceptions and Country Registrations. Depending on the number of exceptions, this can be a weekly or a monthly activity. For more information, see Archive Expired Exceptions and Country Registrations.
  • If multiple exceptions are requested, the IP Security Manager must analyze those requests, and any existing active exceptions, and consolidate them wherever possible.
  • For most practical purposes, the number of IP Security Exceptions should not exceed 10 per class.
  • The same exception can allow access to multiple users and objects.

See Also
Creating an Exception

The Security Officer records and applies for exceptions, assigns and approves exceptions, and discontinues exceptions. The IP Protection Management app includes numerous types of security exceptions out of the box.

The IP Protection Management app uses two types of exceptions:

  • IP Exceptions - Used to document authorization for and grant access to items restricted due to the proprietary nature of those items and includes internal company IP as well the management of proprietary data from customers, suppliers, and partners.
  • Security Exception - Used to document authorization for and grant access to items restricted due to the military or government classification assigned by the related contract for those items. Typical security exception documents include program briefings.

Any exceptions or agreements defined for a security class are linked to it so that the primary Security Officer can see and audit all the exceptions that exist. The exceptions can be undergoing approval, in effect, or archived. With this access the category owner can observe and approve all the exceptions being made even if the majority of the effort is handled by other people in the organization.

Exceptions need formal approval before becoming effective. A company can ensure that the exceptions are enabled properly by the exception policy, time limitation, and limitation on the number of exports. Routes can be approved to make exceptions active.

All exceptions are time limited, which ensures that exceptions are turned off and access revoked automatically if the exception is not renewed.

Exceptions will be disabled or turned off in one of three ways:

  • Manual Promotion - By accessing the exception's lifecycle, the Security Officer promotes the exception to either the Inactive or Archived state. This disables the exception and prevents access to materials classified which otherwise would not be accessible to licensed users.
  • Aging - During the creation of the security exception/document, the Security Officer enters an effective date range for the exception. When the end date passes, the exception is promoted to either the Inactive or Archived state by the system and disabled.
  • Export Quantity - The system tracks the number of times a licensed user accesses classified materials. Once the authorized number has exceeded the lifecycle of the security exception, it is automatically be promoted by the system to the Inactive or Archived state.