text: At this organization , deviations from policies had to be documented in a letter signed by both the executive of the business group requesting the deviation and the central information security group 's manager .
  
  ###
  
  Deviations from policy must be documented by two people .