# OT Network Change Request Form Template

> Source: https://netray.co/tools/ot-network-change-request-form-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A change request form for firewall rules, switch configs and new devices on the plant network, with risk, rollback and production safety approval.

## Category

industry-templates

## Industry

Discrete Manufacturing

## Audience

- IT security lead
- OT engineer
- Controls engineer
- Network administrator

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Change request no.

**Key:** cr_no

**Type:** text

**Default:** OTCR-2026-041

#### Requester

**Key:** requester

**Type:** text

**Default:** J. Alvarez, Controls Engineer

#### Request date

**Key:** date

**Type:** date

**Default:** 2026-10-21

#### Network zone affected

**Key:** zone

**Type:** select

**Options:**

- Level 3 site operations
- Level 2 area control
- Level 1 basic control
- DMZ between IT and OT
- Multiple zones

**Default:** Level 2 area control

#### Change type

**Key:** type

**Type:** select

**Options:**

- New device
- Firewall rule
- Switch or VLAN change
- Remote access change
- Firmware update
- Decommission

**Default:** Firewall rule

#### Planned window

**Key:** window

**Type:** text

**Default:** Sat 2026-10-31, 06:00 to 08:00, line idle

#### Description of change

**Key:** description

**Type:** textarea

**Default:** Allow the new vision inspection station (10.20.4.31) to reach the MES server (10.20.1.10) on TCP 8443 only.

#### Rollback plan

**Key:** rollback

**Type:** textarea

**Default:** Remove the rule and restore the saved firewall configuration backup taken before the change. Rollback takes under 10 minutes.

**Blocks:**

#### Change request {{cr_no}}

**Body:** Requester: {{requester}}
Date: {{date}}
Change type: {{type}}
Zone: {{zone}}
Planned window: {{window}}

#### Description and business reason

**Body:** {{description}}

#### Risk and safety screening

**Table:**

**Columns:**

- Question
- Answer (Yes / No / NA)
- Note

**Rows:**

**0:** Can this change stop or slow a running line?

**0:** Does it affect a safety-rated network or safety PLC?

**0:** Does it open a path between IT and OT?

**0:** Is the vendor or integrator connecting remotely?

**0:** Is a current configuration backup saved?

**0:** Was the change tested in a lab or on a spare unit?

#### Rollback plan

**Body:** {{rollback}}

#### Post-change verification

**Table:**

**Columns:**

- Check
- Result
- Verified by

**Rows:**

**0:** Device or service reachable as intended

**0:** No unintended traffic allowed

**0:** Production data flowing

**0:** Documentation and asset inventory updated

#### Approvals

**Signatures:**

- Requester
- OT / controls lead
- IT security
- Production supervisor
- Change board chair

**Notes:** A starting point for your own change control procedure, not a substitute for it. Changes touching safety systems need review by the responsible safety engineer.

## Content

**Intro:** Most plant network outages and many security gaps start as an unreviewed change: a quick firewall rule, a temporary switch, an integrator's laptop. This form forces scope, risk, rollback and production sign-off onto one page before anyone touches the network.

**Sections:**

#### How to use the form

**Body:** Fill the fields, export to PDF or Word, and route it to the approvers listed. Every request gets a number so it can be matched to the firewall log and the asset inventory later. Emergency changes can use the same form completed after the fact within one business day.

**Bullets:**

- One change per form
- Name exact IPs and ports, not 'any'
- State the production window
- Attach the config backup reference

#### Why OT change control differs from IT

**Body:** In OT a mistaken change can stop a line or affect equipment safety. Windows are tied to production schedules, vendors often need remote sessions, and many devices cannot be patched or rebooted freely. Standards such as IEC 62443 and NIST SP 800-82 expect documented change management and zone separation, which this form supports.

#### Reviewing a request

**Body:** Reject requests with vague scope, permanent rules justified as temporary, or no rollback. Check that the rule is the narrowest that works, that an expiry date exists for vendor access, and that the asset inventory and network diagram are updated after the change.

#### Common mistakes

**Body:** Approving after the work is done, skipping the post-change check, leaving temporary rules in place for years, and not updating the diagram. Review open exceptions quarterly.

**Cta:** If you want firewall rule requests tied to ERP or MES asset records, we can discuss it. The form is free to use as is.

**Faq:**

#### Who should approve an OT network change?

**Answer:** At minimum the OT or controls owner, IT security, and the production supervisor for the affected area. Changes touching safety systems also need the safety engineer. The chair of your change board gives final approval.

#### Do emergency changes need the form?

**Answer:** Yes, completed afterward. Record who authorized it verbally, what was changed and why, then review it within one business day. Repeated emergency changes show a process gap worth fixing.

#### What is a good change window?

**Answer:** A planned stop such as a weekend shift, changeover or maintenance day, agreed with production. Avoid changes during run time on cells that cannot tolerate a network blip.

#### Should this link to the asset inventory?

**Answer:** Yes. Every new, moved or retired device should update the inventory and network diagram. Put that check on the post-change verification table so it is not forgotten.

## Search terms

OT network change request form, ICS change management template, plant network change control form, firewall rule change request template, PLC network change request, OT change management procedure, IEC 62443 change management form, industrial network change request

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json