Cyber Security Exception and Risk Acceptance Form Template
Plants run machines and systems that cannot meet every security policy: legacy operating systems, vendor locked controllers, unpatchable firmware. A formal exception makes the gap visible, adds compensating controls, and puts a named executive behind the decision.
Fill in
Cyber Security Exception and Risk Acceptance Form Template
Exception SEC-EX-2026-012
Requested by: Maintenance Manager Date: 2026-10-22 Asset: 5-axis machining center HMI PC (Windows 7, vendor supported only) Expiry: 2027-04-30 Residual risk: Medium
Control not met
Operating systems must be on a vendor supported version and patched within 30 days
Justification
The machine vendor certifies the control software only on this OS. An upgrade needs a new controller costing about 90,000 USD and a four week outage.
Compensating controls
Isolated VLAN with deny-by-default firewall rules. No internet access. USB ports disabled except for a scanned drive kiosk. Application allow-listing enabled. Logs sent to the central collector.
Remediation plan
| Action | Owner | Target date |
|---|---|---|
| Plan controller replacement or upgrade in capital budget | ||
| Review isolation and rules each quarter | ||
| Re-assess before expiry |
Review and acceptance
Exceptions must expire and be re-reviewed. This is a starting point for your own governance process and is not legal advice.
Review your open security exceptions
Optional second look at compensating controls for legacy plant systems.
Optional. The tool and every export work without this. No spam.
How to use the form
Complete the fields, export to PDF or Word, and route for signature. Be specific about the control not met, why it cannot be met now, what reduces the risk instead, and when the exception ends. Keep approved forms in one register, linked to the asset inventory and the risk register.
- Set an expiry, never open ended
- Name a single accountable executive
- List compensating controls that can be verified
- Link a remediation action with a date
Choosing compensating controls
For unpatchable systems the usual set is network isolation with deny-by-default rules, no internet or email on the device, application allow-listing, controlled removable media, monitoring of traffic to and from the asset, and a tested restore image. The compensating control should address the same threat the original control was meant to stop.
Approving and tracking
Higher residual risk needs higher approval. A reasonable rule is that low risk is approved by IT security, medium by the system owner and IT director, and high by an executive. Review open exceptions quarterly and report their number and age to leadership.
Common mistakes
Renewing the same exception every year with no remediation plan, listing controls that are not actually in place, and letting the requester approve their own request.
Frequently Asked Questions
When is an exception appropriate?
When a control cannot be met in the near term for a valid operational, cost or vendor reason and the risk can be reduced another way. Convenience alone is not a valid reason.
How long should an exception last?
Usually 6 to 12 months, shorter for high risk. Each renewal should show progress on remediation, otherwise it becomes permanent risk with a signature on it.
Who accepts the risk?
A business owner with authority over the consequence, such as the plant manager or an executive, not only IT security. IT advises, the business accepts.
Is this valid for customer audits?
A documented, time boxed exception with compensating controls is generally good evidence. Check the specific framework or contract language, as some requirements allow no exceptions.
If you want exceptions tied automatically to your asset and ERP maintenance records, we can discuss that. The form is complete without it.
Related Tools
Cyber Risk Register Worksheet for Manufacturers
Score IT and OT cyber risks by likelihood and impact, compare inherent and residual risk and track the treatment owner.
Industry TemplatesOT Network Change Request Form Template
A change request form for firewall rules, switch configs and new devices on the plant network, with risk, rollback and production safety approval.
Compliance & ContractsUser Access Review Worksheet for ERP and OT Accounts
List accounts by system and role, flag stale or shared ones and record the keep, change or remove decision.
Compliance & ContractsThird-Party Remote Access Request Form Template
A request and approval form for machine builders, integrators and ERP consultants who need remote access to your systems.
More Compliance & Contracts tools
See all- Used Machinery Bill of Sale Template
- Late Delivery Liquidated Damages Notice Template
- Customer Order Cancellation and Restocking Fee Notice Template
- Contract Termination for Convenience Notice Template
- Equipment Factory Acceptance Certificate Template
- Contract Redline Issue Log Worksheet
- Contract Renewal and Notice Deadline Tracker Worksheet
- Late Delivery Liquidated Damages Calculator
- Late Delivery Liquidated Damages Exposure Calculator