Back Risk Tolerance
Risk Tolerance
Official (ISC)² Certified in Cybersecurity (CC) Self-
Paced Training Unit 2 of 8 32∕51
Chapter 1: Security Principles
The perception management takes toward risk is often likened to the entity’s appetite for
Risk Priorities
risk. How much risk are they willing to take? Does management welcome risk or want to
avoid it? The level of risk tolerance varies across organizations, and even internally:
Decision Making Based on Risk Di@erent departments may have di@erent attitudes toward what is acceptable or
Priorities unacceptable risk.
Understanding the organization and senior management’s attitude toward risk is usually
Risk Tolerance
the starting point for getting management to take action regarding risks.
Video: Risk Tolerance Drives Executive management and/or the Board of Directors determines what is an acceptable
Decision Making level of risk for the organization. Security professionals aim to maintain the levels of risk
within management’s limit of risk tolerance.
Podcast: Swimming with Sharks Often, risk tolerance is dictated by geographic location. For example, companies in
Iceland plan for the risks that nearby volcanoes impose on their business. Companies
that are outside the projected path of a lava Now will be at a lower risk than those
Module 3: Understand Security Controls 0/4
directly in the path’s Now. Similarly, the likelihood of a power outage a@ecting the data
center is a real threat in all areas of the world. In areas where thunderstorms are
Module 4: Understand Governance
0/4 common, power outages may occur more than once a month, while other areas may
Elements and Processes
only experience one or two power outages annually. Calculating the downtime that is
likely to occur with varying lengths of downtime will help to deOne a company’s risk
Module 5: Understand (ISC)² Code of tolerance. If a company has a low tolerance of the risk of downtime, they are more likely
0/5
Ethics
to invest in a generator to power critical systems. A company with an even lower
tolerance for downtime will invest in multiple generators with multiple fuel sources to
Module 6: Chapter 1 Summary 0/4 provide a higher level of assurance that the power will not fail.
End of Unit
