Where a waiver is granted, the waived CoP clause(s) remains subjected to the cybersecurity audit. The auditor should: (i) understand the purpose of the waiver request and the waiver condition; and (ii) validate the effectiveness of compensating controls (where applicable).