Exceptions in Monitoring and Operations
The base process, approval authorities, mandatory fields, chain of authority and lifecycle are defined in Ch. 14 -
addon/12-processo-excecoes.md. This file defines only the specifics of this domain.
Scope
Exceptions to requirements of the monitoring and operations catalogue: OPS-001 to OPS-015. Two scenarios have relevant specifics: alert silencing (OPS-005) and log retention below the regulatory minimum (OPS-003).
Triggers specific to this domain
- an alert temporarily silenced due to scheduled maintenance, excessive false-positive noise, or technical inability to respond within a defined period (OPS-005);
- log retention below the minimum defined in the policy or required by regulation - due to storage constraints, cost or conflict with another legal obligation (OPS-003);
- a log source not integrated into the SIEM due to technical incompatibility or the absence of a connector, with alternative monitoring as compensation (OPS-004);
- an alert response SLA that cannot be met for a given type of event due to a lack of operational capacity, with a reinforcement plan (OPS-006).
Alert silencing - specific requirements
Alert silencing is the highest-risk scenario in this domain: it removes active visibility without leaving automatic evidence. Every silencing exception requires:
- precise identification of the silenced alert (ID, rule, source);
- technical justification of the impossibility of keeping the alert active;
- a silencing period with a mandatory end date - no permanent silencing;
- a compensating visibility control active during the period (e.g. periodic manual review, alternative alert, manual monitoring of the source);
- notification to the person responsible for operational security (SOC lead or equivalent).
Silenced alerts without an end date or without a compensating control are treated as non-compliance.
Log retention - regulatory implications
Below an applicable statutory minimum there is no exception to OPS-003: the statutory minimum prevails (Policy 29 §7), e.g. at least six months for the logs of high-risk AI systems (AI Act, Articles 19(1) and 26(6)). Exceptions with retention below the period set by the entity in its risk assessment (DORA; NIS2, where applicable) or below the internal policy, but never below the statutory minimum, have implications that go beyond technical approval:
- the chain of authority must include legal or compliance validation, not only AppSec;
- the exception must reference the regulatory requirement or the entity's period that is being reduced;
- the maximum time limit is the lower of the ceiling of Policy 05 §7 and what the regulatory risk allows.
Additional mandatory fields (operations)
| Field | Mandatory | Notes |
|---|---|---|
| Affected source / system | Yes | Component, application or infrastructure |
| Silenced alert / rule (if applicable) | Conditional | Mandatory in OPS-005 exceptions |
| Effective retention period vs. required minimum | Conditional | Mandatory in OPS-003 exceptions |
| Regulation or policy compromised | Conditional | Mandatory in exceptions with a regulatory implication |
| Compensating visibility control | Yes | Mechanism active during the exception window |
Cross-references
| Document | Relation |
|---|---|
00-catalogo-requisitos.md | OPS-001..015 catalogue - requirements that may have exceptions |
03-alertas-eventos-criticos.md | Alerts that may be the object of silencing with an exception |
08-matriz-controles-por-risco.md | Controls matrix by risk level |
Ch. 14 - addon/12-processo-excecoes.md | Canonical exception management process |