At this organization, deviations from policies had to be documented in a letter signed by both the executive of the business group requesting the deviation and the central information security group's manager.
Deviations from policy must be documented by two people.
I remember the days when there were only a handful of people in the legal offices who spoke Spanish, Dudovitz said.