Document code:  PRO-0027.06  Security level:  Internal  Effective date:  15/01/2019  ICT Governance  • the exception, for example o the specific part of the ICT Governance that is excepted. Often this takes  the form of bypassing certain steps in the ICT Governance. o A description of what exceptionally can done, regardless of the ICT  Governance. This form does not require the identification and specification  of affected parts of the ICT Governance.  • the scope of the exception, e.g. the relevant Programme / Service / Product /  Project / Release,  • optionally, the validity period of the exception, if granted for example for a  Programme, and  • the party granting the exception (the Director of Information Systems or the  Executive Director).  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  88  of  92 Term or abbreviation  Definition  ADSM  Application Delivery and Service Manager  CAB  Change Advisory Board, manages changes within its scope  CERT  Computer Emergency Response Team, an expert group  with focus on handling computer security incidents.  CIA  Change Impact Assessment  CM  Change Manager  CoM  Contract Manager  Corrective IT Security  Controls Intended to limit the extent of any damage caused by the  incident  Detective / reactive IT  security controls Intended to identify and characterize a security event in  progress in order to activate efficient incident response to  stop and limit the ongoing attack.  DM  Delivery Manager  ECF  Evaluation Coordination Function (for IT investment ex ante  evaluation support and for ex post evaluations)  DMS  ECHA’s electronic Document Management System Emergency Change  A change that needs to be implemented in the fastest  possible yet controlled way (e.g. an issue with high critical  5. Definitions  4. Flowchart  The written record can be in electronic form, for example an email. The party receiving the  exception has the responsibility to store the record about the exception and produce it as  necessary.  In addition to natural expiry, the exception can be revoked by the Executive Director or  the Director of the Information Systems Directorate at any time with a similar written  record than is used for granting an exception.  The flowcharts regarding different parts of the ICT governance have been embedded into  the relevant sections. 