# Product security operating plan and exception register

Blank work product. Replace bracketed fields with system-specific facts. Unknown evidence stays unknown; do not mark a control passed because a template is complete.

## Inventory and ownership

| Product / critical service | Engineering owner | Security contact | Data / risk tier | Release path | Required practices |
| --- | --- | --- | --- | --- | --- |
| [name] | [accountable person] | [contact] | [basis] | [pipeline] | [scoped baseline] |

## Practice and evidence plan

| Decision / practice | Trigger | Owner | Required work product | Acceptance criteria | Where retained |
| --- | --- | --- | --- | --- | --- |
| [design review] | [new trust boundary] | [role] | [review record] | [criteria] | [location] |
| [release verification] | [candidate] | [role] | [artifact-bound evidence] | [criteria] | [location] |
| [response] | [report/advisory] | [role] | [exposure decision] | [criteria] | [location] |

## Exception register

| ID / affected requirement | Exact scope | Risk / compensating control | Accountable accepter | Expiry | Required repair / verification | Expiry action |
| --- | --- | --- | --- | --- | --- | --- |
| [ID] | [product, version, route] | [evidence] | [person with authority] | [date] | [owner, test] | [block, disable, escalate] |

## Outcome measures and next cycle

Choose denominators and time windows before counting: high-risk services with accountable owners; exposure days for verified critical findings; recurrence by root cause; expired exceptions. Include excluded systems and unknown data. Name the smallest improvement, its owner and how the next review will tell whether it helped.