Mechanisms exist to document, assess risk and approve or deny deviations to standardized configurations.