Prior to completing the IT Exception Request form, the following template must be filled out and sent to the supplier. This template details the information necessary to procure from the supplier about their preferred implementation. If, after receiving this email, the supplier is adamant about actions that do not align with the university's best practices, submit the IT Exception Request Form. Although these practices should be followed most of the time, if they have a legitimate reason for having an exception, and steps to resolve any risks, then IT Risk may allow it. However, if the supplier rescinds or significantly amends their request, the form does not need to be submitted.

Email template:

Hello [supplier],

I’ve spoken to IT Security about [requested action] and they have several questions that need to be answered before we can proceed. [requested action] is not a best practice at the university, and puts the University at measurable risk.

• Why is it necessary to [requested action] when [preferred action]?
• Is it on your road map to correct this? If so, when?
• If we need to proceed with [requested action] what compensating controls do you have in place to control risk, and what will IT Services staff also need to do to mitigate this risk?

Please reply to each question in line to make the turnaround on this work as quick as possible. Thanks!

---

For more information about the template, required details, or any additional questions, please contact itrisk@uchicago.edu