Back Risk Tolerance
Risk Tolerance
Official (ISC)² Certified in
Cybersecurity (CC) Self-Paced
Training Unit 2 of 8 32∕51 The perception management takes toward risk is often likened to the
Chapter 1: Security entity’s appetite for risk. How much risk are they willing to take? Does
management welcome risk or want to avoid it? The level of risk
Principles tolerance varies across organizations, and even internally: Di@erent
departments may have di@erent attitudes toward what is acceptable or
Knowledge Check: unacceptable risk.
Risk Treatment
Understanding the organization and senior management’s attitude
toward risk is usually the starting point for getting management to take
Video: Risk action regarding risks.
Management:…
Susan's Good News Executive management and/or the Board of Directors determines what
is an acceptable level of risk for the organization. Security professionals
Video: Risk in Our aim to maintain the levels of risk within management’s limit of risk
Lives tolerance.
Often, risk tolerance is dictated by geographic location. For example,
Risk Priorities companies in Iceland plan for the risks that nearby volcanoes impose
on their business. Companies that are outside the projected path of a
lava Now will be at a lower risk than those directly in the path’s Now.
Decision Making
Similarly, the likelihood of a power outage a@ecting the data center is a
Based on Risk…
real threat in all areas of the world. In areas where thunderstorms are
Priorities
common, power outages may occur more than once a month, while
Risk Tolerance other areas may only experience one or two power outages annually.
Calculating the downtime that is likely to occur with varying lengths of
downtime will help to deOne a company’s risk tolerance. If a company
Video: Risk has a low tolerance of the risk of downtime, they are more likely to
Tolerance Drives… invest in a generator to power critical systems. A company with an even
Decision Making lower tolerance for downtime will invest in multiple generators with
multiple fuel sources to provide a higher level of assurance that the
Podcast: Swimming
power will not fail.
with Sharks
