Before You Submit — Have These Ready
Research Project Description
Describe what you're trying to accomplish and why standard security controls are incompatible.
Specific Security Requirement
Identify which policy, standard, or control you need an exception from — be as specific as possible.
Compensating Controls Proposed
Describe what alternative safeguards you'll put in place (e.g., network isolation, enhanced monitoring, restricted access).
Faculty Sponsor Name
All exception requests require a faculty sponsor who takes responsibility for the risk.
IRB Approval Number (if applicable)
If your exception involves human subjects research data, include your IRB protocol number.
Duration
Specify whether this is a temporary exception (with end date) or a permanent one requiring annual review.
Submit
Fill out the form below with all required details
ITS Review
Security team assesses completeness & risk
CIO Decision
CIO evaluates necessity, controls, & compliance
Controls Applied
Compensating controls implemented if approved
Review & Renew
Temporary exceptions expire; permanent ones reviewed annually
Submit Your Exception Request
Powered by FreshService — your request is tracked and reviewed by the ITS Security team.
Frequently Asked Questions
Exceptions are typically needed for legacy research instruments that can't support modern authentication, specialized lab equipment with incompatible security requirements, legacy software essential to a specific program, academic projects requiring non-standard data sharing, or hardware configurations that fall outside standard endpoint policies.
You do not need to file an exception for: using personal devices for work (covered by the Endpoint Management policy), standard software updates, routine academic activities within approved platforms (Canvas, Microsoft 365, Box, Zoom), or password reset requests.
Simple exceptions with well-documented compensating controls typically take 5–10 business days. Complex requests involving FERPA, GLBA, or HIPAA data may take longer as they require additional compliance review. Contact the Solutions team for a pre-submission consultation if your timeline is tight.
You'll receive a written explanation of the denial and a list of alternative recommendations. In many cases, ITS can propose a modified approach that achieves your academic goal while staying within policy. You may resubmit with updated compensating controls or an adjusted scope.