According to one embodiment of the invention, a method for managing security for an organization is provided. The method includes receiving a plurality of requests from a plurality of parties. Each request is a request for permission to implement a deviation from a security rule. Each request includes a statement describing a benefit associated with the deviation. The method also includes determining a risk associated with the deviation. The method also includes deciding whether to approve each request based on the determined risk and the statement. The method also includes storing the requests and a status of each request. The status indicates whether the request is approved. The stored requests includes at least one approved request. The method also includes deciding, after a predetermined time period, whether to continue an approval of the approved request.