Risk appetite, risk tolerance and aligning security with business objectives

Risk appetite is the amount and type of risk an organization is willing to pursue or accept to achieve its objectives. It is set by the board and senior management, not by the security team. A bank might have a very low appetite for fraud losses but a moderate appetite for risk in launching new digital products. Appetite statements can be qualitative ('we will not accept risks that could cause a regulatory sanction') or quantitative ('no more than a defined amount of expected annual loss from cyber events'). Appetite is not the same everywhere in the business: it is usually stated per category of risk, such as financial, regulatory, operational and reputational.