General Exception Request with Remediation Plan
Office of Compliance Services
Information Security
924 Westwood Blvd, Suite #520
Los Angeles, CA 90095-7067
DO NOT USE THIS FORM FOR LAPTOP ENCRYPTION ,TIMEOUT EXCEPTION AND GENERAL EXCEPTION REQUESTS THAT DO
NOT REQUIRE A REMEDIATION PLAN
For those requests, find custom forms at http://compliance.uclahealth.org/body.cfm?id=70
Instructions:
•
•
•
•
•
Use this form to request policy exceptions when non-compliance with a policy provision is identified and there is a
remediation plan to resolve the non-compliance.
Requestors should complete the first two pages and then email to the Office of Compliance Services - Information Security,
InfoSecAll@mednet.ucla.edu.
If you need more space than the form provides, you may send any additional documentation with the form.
If all necessary information is not provided, the form will be returned to you. Ask your CSC if you need some help with the
technical issues.
If you have any questions, please contact your CSC or the Office of Compliance Services - Information Security, (310)
794-8638
Requestor Information
Name
Date
Phone
Title
Email
Dept
IT Support Contact
Policy statement for which an Exception is being requested
All Devices that are connected to a UCLA network whether owned by UCLA or others shall be
continually executing approved virus scanning software with current virus definitions.
UCLA Health shall run versions of operating systems and application software for which security
patches are made available in a timely manner on network Devices.
Wireless Access Points must comply with HS Policy No. 9457, "Minimum Security Standards,"
Appendix IV, "Wireless Communication Configuration Standard."
OTHER
If there is not enough space on this form to describe the issue(s) and the remediation
plan, please provide the information requested in a separate Word document.
Describe in detail why your area is not currently in compliance on this issue. Include information
on the processes/applications/systems and users involved.
Revision date: 07/22/12
Page 1 of 3
General Exception Request & Remediation Plan
How many systems and/or users are affected?
Describe any controls that are in place now or could be added soon to mitigate the noncompliance.
Describe in detail how the issue will be brought into compliance.
Can remediation be done in stages so higher risk issues can be resolved earlier? If so, please
describe the stages and include a timeline.
What is the final completion date for the remediation?
Revision date: 07/22/12
Page 2 of 3
General Exception Request & Remediation Plan
Information Security Review
Reviewer
Approve exception request?
Date
YES
NO
Comments
Leadership Review
Reviewer
Approve exception request?
Date
YES
NO
Comments
Revision date: 07/22/12
Page 3 of 3