RISK ACCEPTANCE MEMO TEMPLATE

Supporting Memo · Residual Risk · Business Rationale · Conditions · Expiration

Table of Contents

1. Purpose and Use
2. Template Instructions
3. Fill-In Template
4. Review and Approval
5. Document Control

1. Purpose and Use

This memo is a lightweight supporting artifact for a risk acceptance decision governed by CERG-GOV-RMF-001 §9.7 and submitted through CERG-TMPL-RM-004. It may summarize rationale, conditions, and review triggers, but it does not create a separate acceptance path. The completed memo must attach to the Risk Acceptance Request Form, link to the risk register, and must not replace either artifact.

Acceptance Is a Decision, Not an Absence of Action

Risk is not accepted because nobody fixed it. Risk is accepted only when the right authority understands the scenario, impact, residual exposure, conditions, expiration, and alternatives, then records the decision. The Business Owner accepts the business consequence; Security assesses and recommends but does not accept business risk.

2. Template Instructions

1. Use this memo only as an attachment or supporting decision narrative for CERG-TMPL-RM-004.
2. Replace every bracketed field with case-specific information.
3. Do not delete fields that appear not applicable. Mark them Not Applicable and explain why.
4. Use canonical CERG role names from CERG-GOV-OM-001 and approval authority from CERG-GOV-RMF-001 §9.7.
5. Link risks, findings, exceptions, evidence, and approvals to the system of record.
6. Store the completed artifact with the completed Risk Acceptance Request Form and risk-register entry in the evidence library governed by CERG-PRC-AUD-001.

3. Fill-In Template

3.1 Decision Summary

3.2 Business Rationale

[Explain why acceptance is appropriate compared with mitigation, transfer, or avoidance.]

3.3 Conditions of Acceptance

3.4 Alternatives Considered

3.5 Expiration and Review

4. Review and Approval

Approval authority follows CERG-GOV-RMF-001 §9.7 and is recorded on CERG-TMPL-RM-004. This memo is not valid unless the required TMPL-RM-004 approvals are complete.

Completed templates are reviewed at the cadence defined by their parent procedure or plan. Material changes require a new review through TMPL-RM-004.

5. Document Control

Revision History

Review Triggers

• Parent procedure or plan change
• Audit, assessment, or tabletop finding related to this template
• Role or approval model change
• Direction from the CISO

Related Documents

Source: templates/CERG-TMPL-RM-003_Risk_Acceptance_Memo_Template.md · Download .md · View on GitHub