An apparatus comprising: processing circuitry to perform data processing in one of a plurality of security domains including at least a secure domain and a less secure domain, and within a given security domain, to perform data processing in one of a plurality of modes, including a handler mode for exception processing and a thread mode for background processing; memory access checking circuitry to check whether a memory access is allowed depending on a current security domain of the processing circuitry; and characterised by : exception control circuitry responsive to an exception condition to perform one of a plurality of exception entry transitions selected based on a current mode and the current security domain of the processing circuitry, and a security domain associated with the exception condition, the plurality of exception entry transitions including at least one secure thread mode to secure handler mode exception entry transition; in which: the exception control circuitry is responsive to an exception return condition to perform one of a plurality of exception return transitions selected based on the mode and security domain associated with the exception return condition; in response to the at least one secure thread mode to secure handler mode exception entry transition the exception control circuitry is configured to set a transition disable indicator; and for at least one type of exception return transition to processing in the secure domain and the thread mode when the transition disable indicator is set, the exception control circuitry is configured to trigger signalling of a fault. processing circuitry to perform data processing in one of a plurality of security domains including at least a secure domain and a less secure domain, and within a given security domain, to perform data processing in one of a plurality of modes, including a handler mode for exception processing and a thread mode for background processing; memory access checking circuitry to check whether a memory access is allowed depending on a current security domain of the processing circuitry; and characterised by : exception control circuitry responsive to an exception condition to perform one of a plurality of exception entry transitions selected based on a current mode and the current security domain of the processing circuitry, and a security domain associated with the exception condition, the plurality of exception entry transitions including at least one secure thread mode to secure handler mode exception entry transition; in which: the exception control circuitry is responsive to an exception return condition to perform one of a plurality of exception return transitions selected based on the mode and security domain associated with the exception return condition; in response to the at least one secure thread mode to secure handler mode exception entry transition the exception control circuitry is configured to set a transition disable indicator; and for at least one type of exception return transition to processing in the secure domain and the thread mode when the transition disable indicator is set, the exception control circuitry is configured to trigger signalling of a fault. the exception control circuitry is responsive to an exception return condition to perform one of a plurality of exception return transitions selected based on the mode and security domain associated with the exception return condition; in response to the at least one secure thread mode to secure handler mode exception entry transition the exception control circuitry is configured to set a transition disable indicator; and for at least one type of exception return transition to processing in the secure domain and the thread mode when the transition disable indicator is set, the exception control circuitry is configured to trigger signalling of a fault. <EOS>