# Cyber Security Exception and Risk Acceptance Form Template

> Source: https://netray.co/tools/cyber-security-exception-and-risk-acceptance-form-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Record a policy exception for an unpatchable machine, legacy OS or vendor limitation, with compensating controls, expiry and executive acceptance.

## Category

compliance-legal

## Industry

Discrete Manufacturing

## Audience

- IT security lead
- CISO
- Plant manager
- Compliance manager

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Exception reference

**Key:** ref

**Type:** text

**Default:** SEC-EX-2026-012

#### Requested by

**Key:** requester

**Type:** text

**Default:** Maintenance Manager

#### Date

**Key:** date

**Type:** date

**Default:** 2026-10-22

#### Asset or system

**Key:** asset

**Type:** text

**Default:** 5-axis machining center HMI PC (Windows 7, vendor supported only)

#### Control or policy not met

**Key:** control

**Type:** text

**Default:** Operating systems must be on a vendor supported version and patched within 30 days

#### Reason the control cannot be met

**Key:** reason

**Type:** textarea

**Default:** The machine vendor certifies the control software only on this OS. An upgrade needs a new controller costing about 90,000 USD and a four week outage.

#### Compensating controls

**Key:** compensating

**Type:** textarea

**Default:** Isolated VLAN with deny-by-default firewall rules. No internet access. USB ports disabled except for a scanned drive kiosk. Application allow-listing enabled. Logs sent to the central collector.

#### Expiry date

**Key:** expiry

**Type:** date

**Default:** 2027-04-30

#### Residual risk rating

**Key:** rating

**Type:** select

**Options:**

- Low
- Medium
- High

**Default:** Medium

**Blocks:**

#### Exception {{ref}}

**Body:** Requested by: {{requester}}
Date: {{date}}
Asset: {{asset}}
Expiry: {{expiry}}
Residual risk: {{rating}}

#### Control not met

**Body:** {{control}}

#### Justification

**Body:** {{reason}}

#### Compensating controls

**Body:** {{compensating}}

#### Remediation plan

**Table:**

**Columns:**

- Action
- Owner
- Target date

**Rows:**

**0:** Plan controller replacement or upgrade in capital budget

**0:** Review isolation and rules each quarter

**0:** Re-assess before expiry

#### Review and acceptance

**Signatures:**

- Requester
- IT security
- System owner
- Executive risk owner

**Notes:** Exceptions must expire and be re-reviewed. This is a starting point for your own governance process and is not legal advice.

## Content

**Intro:** Plants run machines and systems that cannot meet every security policy: legacy operating systems, vendor locked controllers, unpatchable firmware. A formal exception makes the gap visible, adds compensating controls, and puts a named executive behind the decision.

**Sections:**

#### How to use the form

**Body:** Complete the fields, export to PDF or Word, and route for signature. Be specific about the control not met, why it cannot be met now, what reduces the risk instead, and when the exception ends. Keep approved forms in one register, linked to the asset inventory and the risk register.

**Bullets:**

- Set an expiry, never open ended
- Name a single accountable executive
- List compensating controls that can be verified
- Link a remediation action with a date

#### Choosing compensating controls

**Body:** For unpatchable systems the usual set is network isolation with deny-by-default rules, no internet or email on the device, application allow-listing, controlled removable media, monitoring of traffic to and from the asset, and a tested restore image. The compensating control should address the same threat the original control was meant to stop.

#### Approving and tracking

**Body:** Higher residual risk needs higher approval. A reasonable rule is that low risk is approved by IT security, medium by the system owner and IT director, and high by an executive. Review open exceptions quarterly and report their number and age to leadership.

#### Common mistakes

**Body:** Renewing the same exception every year with no remediation plan, listing controls that are not actually in place, and letting the requester approve their own request.

**Cta:** If you want exceptions tied automatically to your asset and ERP maintenance records, we can discuss that. The form is complete without it.

**Faq:**

#### When is an exception appropriate?

**Answer:** When a control cannot be met in the near term for a valid operational, cost or vendor reason and the risk can be reduced another way. Convenience alone is not a valid reason.

#### How long should an exception last?

**Answer:** Usually 6 to 12 months, shorter for high risk. Each renewal should show progress on remediation, otherwise it becomes permanent risk with a signature on it.

#### Who accepts the risk?

**Answer:** A business owner with authority over the consequence, such as the plant manager or an executive, not only IT security. IT advises, the business accepts.

#### Is this valid for customer audits?

**Answer:** A documented, time boxed exception with compensating controls is generally good evidence. Check the specific framework or contract language, as some requirements allow no exceptions.

## Search terms

security exception request form, risk acceptance form template, policy exception template cyber, compensating controls form, legacy system exception request, unpatched system risk acceptance, OT exception request, cyber risk acceptance sign-off

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json