RISK ACCEPTANCE REQUEST FORM

Business Owner Acceptance · Residual Risk · Per-RMF-001 Authority · Conditions · Expiration

Table of Contents

1. Purpose and Use
2. Template Instructions
3. Fill-In Template
4. Review and Approval
5. Document Control

1. Purpose and Use

This form records a formal risk acceptance decision under the authority framework defined in CERG-GOV-RMF-001 §9.7. It is used when leadership chooses to accept residual risk rather than mitigate, transfer, or avoid it.

This form is for risk acceptances only. For deviations from policy or standards (where the control itself is not implemented as written), use the Security Exception Request Form CERG-TMPL-RM-002 — which follows the Governance-tracked exception register workflow.

Key distinction per RMF-001 §9.7a: - Policy Exception (→ TMPL-RM-002): A specific control or standard cannot be met. Governance approves. Risk assesses. The exception lives in the exception register. - Risk Acceptance (→ this form): The residual risk after controls is within appetite. The Business Owner accepts the business consequence. Approval follows the RMF-001 §9.7 authority table. The acceptance lives in the risk register.

Acceptance Is a Business Decision, Not a Security Decision

Security assesses, recommends, and validates. The Business Owner accepts the business consequence of residual risk. No one in Security accepts business risk on behalf of the organization. Every acceptance requires the Business Owner’s documented signature at the authority level specified in RMF-001 §9.7.

2. Template Instructions

1. Copy this template before use.
2. Replace every bracketed field with case-specific information.
3. Do not delete fields that appear not applicable. Mark them Not Applicable and explain why.
4. Use canonical CERG role names from CERG-GOV-OM-001.
5. Link risks, findings, acceptances, evidence, and approvals to the system of record.
6. Store the completed artifact in the evidence library governed by CERG-PRC-AUD-001.
7. The Business Owner must review and sign Section 4 before submission to CERG.

3. Fill-In Template

3.1 Decision Summary

3.2 Business Decision Box

3.3 Business Rationale

[Explain why acceptance is the appropriate treatment compared with mitigation, transfer, or avoidance. Address: cost-to-fix vs. residual risk, operational constraints, compensating control adequacy, and regulatory implications.]

3.4 Alternatives Considered

3.5 Risk Assessment (Prepared by CERG Risk)

3.6 Conditions of Acceptance

3.7 Expiration and Review

4. Review and Approval

Approval authority follows CERG-GOV-RMF-001 §9.7. An acceptance is not valid until all required signatures are recorded.

Approver Note: Approvers may delegate within their authority but shall document the delegation. No acceptance expires automatically; every acceptance at every tier requires a fresh approval cycle at expiration. Renewal more than twice without material progress toward remediation escalates one approval tier above the original approver.

5. Document Control

Revision History

Review Triggers

• Parent procedure or plan change
• Audit, assessment, or tabletop finding related to this template
• Role or approval model change
• Direction from the CISO

Related Documents

SURGE, Cyber Engineering, Risk & Governance

Assess it. Accept it. Own it. Review it.

CERG-TMPL-RM-004 · Version 1.2 · Public

Source: templates/CERG-TMPL-RM-004_Risk_Acceptance_Request_Form.md · Download .md · View on GitHub