Terms / Assessment
Enduring exception
A system where full compliance is not feasible and never will be. Documented in your SSP with mitigations, it is assessed as met.
Also called enduring exceptions.
Official Source Material
Enduring Exception means a special circumstance or system where remediation and full compliance with CMMC security requirements is not feasible. Examples include systems required to replicate the configuration of 'fielded' systems, medical devices, test equipment, OT, and IoT. No operational plan of action is required but the circumstance must be documented within a system security plan. Specialized Assets and GFE may be enduring exceptions.
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
An enduring exception is permanent by nature, and the rule accepts that.
Some systems cannot be brought into full compliance and never will be. A controller that must replicate a fielded configuration, a medical device, a piece of test equipment. The rule names these examples itself. It does not ask you to fix them. It asks you to document the circumstance and manage the risk around it.
Documented in your plan with mitigations, it is assessed as met.
Section 170.24(b)(1)(i) says an enduring exception described in the system security plan, along with any mitigations, is assessed as met. No operational plan of action is required, because there is nothing to plan toward. The mitigations are the substance: what surrounds the system, what can reach it, and who may operate it.
This is not the same as a temporary deficiency, and the test is feasibility.
A temporary deficiency has a known fix in progress. An enduring exception has no feasible fix. Choosing the wrong one is a common error. If a fix exists and you are working toward it, it is temporary. If the system cannot be changed without ceasing to do its job, it is enduring.
Most enduring exceptions are also specialized assets, and the treatments stack.
The rule says specialized assets and Government furnished equipment may be enduring exceptions. In practice a shop floor controller is often both: documented as a specialized asset for scoping under CM.L2-3.4.1, and described as an enduring exception where a requirement cannot be met. Say both things in the plan rather than choosing one.
What falls short
- An exception claimed for a system you simply have not upgraded. Not feasible is a much stronger claim than not yet done.
- An exception recorded with no mitigations. The mitigations are what the finding of met rests on.
- An exception held outside the plan. The rule requires the circumstance to be documented within the system security plan.
Edge cases
- Government furnished equipment arrives with a configuration you may not alter. That is a clean example, and the constraint belongs in the plan.
- The vendor later releases a fix. The exception stops being enduring, and it becomes work you schedule.
- A system is an enduring exception for one requirement only. Record it per requirement rather than exempting the system as a whole.
Over-engineering
- Replacing production equipment to remove an exception the rule already accommodates. Document it and spend the money on the mitigations.
- A risk acceptance process modeled on a large enterprise. A clear paragraph, named mitigations, and an owner are what is asked.