One of the areas I see a lot of organizations struggle with is managing exceptions to configuration policy, especially in a rigorous, well documented way that doesn't, frankly, make their security and compliance teams crazy. Let me give you an example...