Information Security Handbook

What is your organization's business risk appetite?

Risk appetite speaks to the level of risk tolerance your organization is willing to accept. There are two aspects to risk appetite that must be investigated:

• How much risk is your organization willing to tolerate?
• How much is your organization willing to spend to reduce risk?

Understanding your organization's risk appetite is a key element to building a successfully-sized information security program. If your organization has a very low risk appetite, then you will most likely have a very robust information security program designed to identify and mitigate risks to the lowest extent possible. Comparing this to an organization with a high-risk appetite, your organization may choose to ...