Skip to main content

Exceptions to Application Security Requirements

The base process, approval authorities, mandatory fields, chain of authority and lifecycle are defined in Ch. 14 - addon/12-processo-excecoes.md. This file defines only the specifics of this domain.

Scope​

Exceptions to requirements of the application catalogue: AUT, ACC, LOG, SES, VAL, ERR, CFG, ENC, API, INT.

Triggers specific to this domain​

  • framework or library without native support for the control (e.g. absence of MFA, limited input validation);
  • third-party component integrated with no possibility of modification within the scope of the project;
  • MVP or proof-of-concept context with an explicitly bounded L1 risk scope;
  • conflict with a functional or contractual requirement, with documented evidence;
  • progressive migration of a legacy system with a known and time-bounded window of non-compliance.

Identification of the affected requirement​

The "Affected requirement" field must identify:

  • the canonical ID from the application catalogue (e.g. AUT-003, VAL-002, ENC-005);
  • the project's operational tag (e.g. SEC-L2-AUT-003).

Cross-references​

DocumentRelation
01-catalogo-requisitos.mdApplication catalogue - requirements that may have exceptions
04-rastreabilidade-controlo.mdTraceability matrix where the exception is recorded
Ch. 14 - addon/12-processo-excecoes.mdCanonical exception management process