Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. It is set by the board, expressed in a written statement, and in most organizations it has no connection whatsoever to the metrics the security function reports.
Closing that gap is most of the value in a measurement programme.
Appetite is what the organization wants to accept.
Tolerance is the variation around that which it will put up with before acting.
Capacity is the maximum it could absorb before serious damage, regardless of preference.
Appetite should sit below capacity. Where it does not, the statement is aspirational.
Appetite statements are written in language that cannot be measured. “We have a low appetite for cyber risk affecting customer data.”
Nobody disagrees with it. Nobody can tell whether it is being met.
Six months later the security function reports a set of operational metrics that have no stated relationship to the appetite statement, and the board is left to form an impression rather than reach a judgement.
Take each appetite statement and ask which observable conditions would indicate it is being exceeded.
Low appetite for disruption to customer-facing services might translate into a maximum tolerable recovery time for those services, a minimum verified restore coverage, and a maximum age for unpatched exposure on the systems supporting them.
Each of those becomes a KRI with a threshold traceable back to the appetite statement it derives from.
The traceability is the point. When a threshold is breached, the escalation is not a security team preference. It is the organization’s own stated appetite being exceeded, which is a much stronger position to escalate from.
Appetite should be revisited when the business changes, not on a fixed annual rhythm out of habit. A new market, a major acquisition, a shift to direct-to-consumer, a new regulatory regime.
And it should be tested against behaviour. An organization that consistently accepts risks beyond its stated appetite does not have an appetite statement, it has a document.
From the blog