Security exception
A security exception is an explicitly approved departure from a security requirement for a defined scope, managed under the organization's policy and risk-acceptance process.
The request and the permission are separate
A vendor asking to bypass a protection has made a request, not granted itself authority. Establish the problem, the proposed change, and who may approve it. NIST’s configuration-management controls call for review of changes and their security impact; the organization’s policy determines its exception process.
Record the affected systems or users, the reason, the owner, and the limits of approval. For a temporary exception, set an end date and someone responsible for removal. A continuing exception needs an explicit review schedule rather than an assumption that the original approval lasts forever.
Name the control that changes
“Allow the tool” can mean several different things. Microsoft distinguishes antivirus exclusions, indicators, and other protection settings, and advises investigating alternatives before creating an exclusion. The antivirus-exception article explains why the exact setting and scope matter.
Releasing one quarantined message is also different from allowing future messages from its sender. The quarantine-release guide follows those separate decisions.
Close the exception by checking that the affected setting has been restored, not just that the ticket has been closed. During an assessment, record exceptions such as allowlisting or suppressed alerts alongside the result. The technical follow-on guide explains why those test conditions matter.