The verbal risk acceptance

The acceptance is not valid for three reasons. First, authority: the organisation's criteria reserve risks rated 16 and above for executive management, and the plant manager is not executive management. Second, form: risk acceptance must be documented, including the risk description, rationale, any compensating controls, the acceptance period and the approver. A verbal statement leaves no auditable record and is easily reinterpreted later. Third, substance: 'we accept until next year's capex cycle' is not a treatment decision unless the residual risk has been evaluated and the acceptance is time-bound and approved at the right level.

The CISO should not manufacture a retrospective acceptance. Instead, escalate both risks to executive management with a clear description of potential impact on production, product quality and regulatory obligations. Propose interim compensating controls while capex is sought, such as network segmentation, restricting the workstation's reach, enhanced monitoring or virtual patching. Record the residual risk after those controls and ask executive management to accept that residual risk explicitly, with an expiry date. The certification deadline is irrelevant to the validity of acceptance; a rushed, undocumented acceptance creates a more serious governance finding than an open treatment plan.

A defensible plan should state, for each risk: the specific treatment option chosen (modify, avoid, share or retain), the concrete actions, the accountable owner, the resources and budget, the target date, dependencies, and the expected effect on likelihood and impact. Vague entries such as 'mitigate - Q4' are not plans.

For the engineering workstation, actions might include isolating it on a segmented OT zone, removing its route to the production line, applying vendor-approved patches during a maintenance window, and adding monitoring for anomalous connections. For the legacy VPN appliance, actions might include replacing it, restricting access to named users with multi-factor authentication, or terminating it in favour of an alternative remote-access service. Each action needs an owner and date.

Residual risk must be reassessed after treatment, using the same method as the original assessment. If residual risk remains above the acceptance criteria, it must go to the authorised approver with the rationale and any further controls. The plan and acceptance should be reviewed at defined intervals and when circumstances change. The risk register, treatment plan, acceptance record and management review minutes should tell one consistent story.

The CISO should separate the two issues. Certification is a conformity assessment; the objective is to demonstrate that risks are being managed, not that every risk has been eliminated. An open, approved treatment plan with interim controls and executive visibility is generally more defensible than a fabricated closure.

The CISO should present executive management with options and consequences: fund the capex early, approve a time-limited risk acceptance with compensating controls, or accept the possibility of an audit finding. The CISO should not sign off acceptance outside their authority, backdate documents, or reclassify the risks to avoid escalation. The audit finding, if raised, should be handled through corrective action: root-cause analysis, correction, corrective action, and review of effectiveness.

A useful test is whether the CISO would be comfortable explaining the decision to a regulator or to the board after an incident. If the answer depends on a verbal assurance that no one recorded, the control environment is not operating effectively. The certification deadline may influence sequencing, but it must not determine the risk decision.