OT cyber governance has to reach the site
A policy reduces risk where the site can apply it. A standard written for IT does not automatically hold in an OT environment. Availability comes first for the people running the process, the equipment may be old, and a supplier may be the only party who can change it.
The owner is local because the consequence is local. The person who can stop a process, accept an exception or live with a legacy constraint is rarely the person who wrote the policy. Governance has to name that person. An exception that is not recorded is just a standard that is already being missed.
Risk acceptance is a decision. It says what is exposed, why the operational constraint is real, who accepts it, and when it will be reviewed. Central reporting is useful when it shows those decisions. A list of findings the site cannot act on is the same risk, still unowned.
The test is practical. Can the site say what will be done differently, who will do it, and what will not be done because the operation cannot bear it? If not, the policy has not reached the site.