問題文
A car rental company's policy forbids shared accounts, but a legacy kiosk application cannot support individual logins and will not be replaced for a year. Which handling of this situation is consistent with sound governance?
選択肢
- Amend the policy, so that shared accounts are permitted wherever an application does not support individual logins, which removes the conflict for this kiosk and later ones.
- Quietly leave the kiosk out of scope for the access review, because the policy cannot be met by that application, and raising the point only generates paperwork that changes nothing about the way the kiosk works.
- Disable the kiosk until the replacement application is delivered, because a control that the policy makes mandatory cannot be set aside for any reason.
- Record a time-limited exception that names the accountable manager, states the compensating measures such as camera coverage and session logging, sets a review date and is approved at the level that owns the policy.