OT Network Change Request Form Template
Most plant network outages and many security gaps start as an unreviewed change: a quick firewall rule, a temporary switch, an integrator's laptop. This form forces scope, risk, rollback and production sign-off onto one page before anyone touches the network.
Fill in
OT Network Change Request Form Template
Change request OTCR-2026-041
Requester: J. Alvarez, Controls Engineer Date: 2026-10-21 Change type: Firewall rule Zone: Level 2 area control Planned window: Sat 2026-10-31, 06:00 to 08:00, line idle
Description and business reason
Allow the new vision inspection station (10.20.4.31) to reach the MES server (10.20.1.10) on TCP 8443 only.
Risk and safety screening
| Question | Answer (Yes / No / NA) | Note |
|---|---|---|
| Can this change stop or slow a running line? | ||
| Does it affect a safety-rated network or safety PLC? | ||
| Does it open a path between IT and OT? | ||
| Is the vendor or integrator connecting remotely? | ||
| Is a current configuration backup saved? | ||
| Was the change tested in a lab or on a spare unit? |
Rollback plan
Remove the rule and restore the saved firewall configuration backup taken before the change. Rollback takes under 10 minutes.
Post-change verification
| Check | Result | Verified by |
|---|---|---|
| Device or service reachable as intended | ||
| No unintended traffic allowed | ||
| Production data flowing | ||
| Documentation and asset inventory updated |
Approvals
A starting point for your own change control procedure, not a substitute for it. Changes touching safety systems need review by the responsible safety engineer.
Review your OT change process
Optional short review of how network changes are approved and recorded across IT and OT.
Optional. The tool and every export work without this. No spam.
How to use the form
Fill the fields, export to PDF or Word, and route it to the approvers listed. Every request gets a number so it can be matched to the firewall log and the asset inventory later. Emergency changes can use the same form completed after the fact within one business day.
- One change per form
- Name exact IPs and ports, not 'any'
- State the production window
- Attach the config backup reference
Why OT change control differs from IT
In OT a mistaken change can stop a line or affect equipment safety. Windows are tied to production schedules, vendors often need remote sessions, and many devices cannot be patched or rebooted freely. Standards such as IEC 62443 and NIST SP 800-82 expect documented change management and zone separation, which this form supports.
Reviewing a request
Reject requests with vague scope, permanent rules justified as temporary, or no rollback. Check that the rule is the narrowest that works, that an expiry date exists for vendor access, and that the asset inventory and network diagram are updated after the change.
Common mistakes
Approving after the work is done, skipping the post-change check, leaving temporary rules in place for years, and not updating the diagram. Review open exceptions quarterly.
Frequently Asked Questions
Who should approve an OT network change?
At minimum the OT or controls owner, IT security, and the production supervisor for the affected area. Changes touching safety systems also need the safety engineer. The chair of your change board gives final approval.
Do emergency changes need the form?
Yes, completed afterward. Record who authorized it verbally, what was changed and why, then review it within one business day. Repeated emergency changes show a process gap worth fixing.
What is a good change window?
A planned stop such as a weekend shift, changeover or maintenance day, agreed with production. Avoid changes during run time on cells that cannot tolerate a network blip.
Should this link to the asset inventory?
Yes. Every new, moved or retired device should update the inventory and network diagram. Put that check on the post-change verification table so it is not forgotten.
If you want firewall rule requests tied to ERP or MES asset records, we can discuss it. The form is free to use as is.
Related Tools
Third-Party Remote Access Request Form Template
A request and approval form for machine builders, integrators and ERP consultants who need remote access to your systems.
Compliance & ContractsCyber Security Exception and Risk Acceptance Form Template
Record a policy exception for an unpatchable machine, legacy OS or vendor limitation, with compensating controls, expiry and executive acceptance.
Compliance & ContractsCyber Risk Register Worksheet for Manufacturers
Score IT and OT cyber risks by likelihood and impact, compare inherent and residual risk and track the treatment owner.
Industry TemplatesRansomware Tabletop Exercise Scenario Template
Fill in your plant, ERP and OT details and get a facilitator-ready ransomware tabletop scenario with injects, discussion questions and an after-action section.
More Industry Templates tools
See all- OEE Improvement A3 Charter Template
- Customer Order Change Request Form Template
- Plant Network Segmentation Checklist (Purdue Model)
- Server Room UPS Runtime and Sizing Calculator
- Server Room Cooling Load BTU Calculator
- Ransomware Downtime Cost Calculator for Manufacturers
- Plant Switch Port Budget Worksheet
- Industrial Protocol and Plant IT TCP/UDP Ports Reference
- Plant Network VLAN and IP Addressing Plan Worksheet