What is required for a waiver to the electronic devices policy?

• A. It must be verbal and approved by the Director
• B. It must be in writing and approved by the Director, CA SAPCO
• C. It can be submitted informally by any staff member
• D. It has no formal requirement

Answer: (B)

A waiver to the electronic devices policy requires a formal process to ensure accountability and compliance with security protocols. The correct requirement states that it must be documented in writing and approved by the Director, as well as the CA SAPCO (Security Assurance Program Coordinating Authority). This written requirement provides a clear record of the waiver's existence and the rationale behind it, which is essential for maintaining security integrity, tracking exceptions to policy, and mitigating risks associated with the use of electronic devices in sensitive areas.

This process ensures that waivers are not granted lightly and are subject to scrutiny by designated authorities, protecting sensitive information and maintaining security standards. The involvement of both the Director and the CA SAPCO indicates a layered approach to decision-making in sensitive areas, which is critical in safeguarding against potential breaches or misuse of electronic devices.