Cyber Risk Appetite and Tolerance: How to Set Them

Every security decision is really a risk decision. Should we accept this legacy system for another year? Is this much spend on detection enough? Can we live with this supplier’s weak controls? Without an agreed view of how much risk the organisation is willing to carry, these decisions get made inconsistently, in the moment, by whoever shouts loudest. Defining cyber risk appetite and tolerance replaces that with a deliberate, board-owned position.

The two terms are often confused, so getting the distinction right is the first step. This guide explains both, then shows how to set them in a way that actually changes decisions rather than sitting in a policy nobody reads.

Appetite versus tolerance: the difference that matters

Risk appetite is the strategic statement of how much and what kind of cyber risk you are willing to take on to pursue your goals. It is directional and qualitative: a hospital might state it has a very low appetite for any risk that could compromise patient safety or clinical systems.

Risk tolerance is the measurable limit around that appetite for a specific risk. It is the concrete line. For that same hospital, a tolerance might be that no clinical system may be unavailable for more than 15 minutes, or that no patient record may be exposed externally, full stop.

Put simply: appetite is the philosophy, tolerance is the threshold. You need both. Appetite without tolerance is a nice sentiment with no teeth; tolerance without appetite is a set of arbitrary numbers no one can explain.

Why this is a board decision, not an IT one

Accepting risk means accepting potential consequences, financial, legal, operational and reputational. Only the people accountable for those consequences can legitimately accept them, which means the board and executive own risk appetite. The role of the CISO or a virtual CISO is to frame the choices, quantify the consequences in business terms, and make sure leadership understands what they are signing up for.

This matters for governance. For APRA-regulated entities, CPS 234 expects the board to be ultimately responsible for information security, which is impossible without an articulated appetite. For government bodies, frameworks such as the NSW Cyber Security Policy similarly push accountability up to agency heads. A defined appetite is how that accountability becomes real rather than nominal.

How to define your risk appetite

Start by grounding appetite in the business, not in security jargon. Work through what the organisation values most and what outcomes would be unacceptable. A workable process looks like this:

1. Identify your key risk categories. Common ones are confidentiality of sensitive data, availability of critical services, financial loss, regulatory non-compliance, and reputational harm.
2. Agree a qualitative appetite for each. Use a simple scale such as averse, minimal, cautious, or open. Most organisations are averse to risks affecting safety, customer data and regulatory compliance, and more open on lower-stakes internal systems.
3. Vary appetite by asset class. A single blanket statement is rarely useful. Differentiating between crown-jewel systems and low-value internal tools is what makes appetite practical.
4. Write it down in plain language. An appetite statement should be a paragraph a director can read aloud and agree with, not a heat map only the security team understands.

Translating appetite into measurable tolerance

Once appetite is agreed, convert it into thresholds people can actually monitor against. This is where the strategy becomes operational. Good tolerance statements share three features: they are specific, measurable, and tied to a consequence and a response.

• Availability: “No customer-facing transaction system may be unavailable for more than 30 minutes during business hours.” Breach triggers a major incident and executive notification.
• Confidentiality: “Zero tolerance for unauthorised external disclosure of regulated personal information.” Any breach triggers mandatory assessment under the Notifiable Data Breaches scheme.
• Patching: “Critical vulnerabilities on internet-facing systems must be remediated within 48 hours.” Aligns directly with Essential Eight expectations.
• Third parties: “No supplier handling sensitive data may operate below an agreed minimum control standard.” Breach triggers remediation or contract review.

Notice that each threshold connects to a defined action. A tolerance with no response when it is breached is just a number on a slide.

It helps to express tolerances in the units the relevant decision-maker already uses. A board that thinks in dollars and reputation responds better to “an incident causing more than X in losses or triggering mandatory breach notification is outside tolerance” than to a control-level metric. An operations manager, by contrast, will act on a downtime or patch-latency number. The same underlying appetite can be expressed at different altitudes for different audiences, and doing so is what makes the statements usable in day-to-day work rather than confined to a governance paper.

Quantifying risk to inform the conversation

Appetite and tolerance are easier to set when the conversation is grounded in some sense of scale. You do not need elaborate quantification to start, but it helps to estimate, even roughly, the plausible impact of your top risks. What would a multi-day outage of your core service actually cost in revenue, penalties and recovery? How many records would a breach of your main customer database expose, and what would notification and remediation involve? These figures do not need to be precise; they need to be good enough to let leadership feel the difference between risks and set thresholds that match real consequences. Over time, you can refine this with better data, but even a first-pass estimate turns an abstract debate into a concrete one.

Using appetite and tolerance to drive decisions

The whole point is to influence real choices, so embed the statements where decisions happen. When a risk is identified and assessed, compare it against appetite and tolerance. If it sits within appetite, accept and monitor it. If it exceeds tolerance, it must be treated, transferred or, only with explicit executive sign-off, formally accepted as an exception with a review date.

This gives you a clean, defensible decision logic. Investment prioritisation becomes clearer too: spend goes first to risks that breach tolerance, not to whatever is most fashionable. And risk acceptance becomes a conscious, documented act rather than a default that happens because nobody decided. That documentation is invaluable when a regulator or auditor later asks why a particular risk was carried.

Common mistakes to avoid

A few failure patterns recur. The first is setting appetite so vague it is meaningless, such as “we have a low appetite for cyber risk” with no thresholds behind it. The second is setting tolerances no one ever measures, so breaches pass unnoticed. The third is treating the statements as a one-off compliance artefact rather than a living tool, never revisiting them as the business and threat landscape change. The fourth is defining appetite in a vacuum, disconnected from the actual controls and roadmap, so the stated appetite and the real exposure drift apart.

Avoiding these comes down to discipline: make the statements specific, measure against them, review them at least annually, and tie them to your broader security strategy and controls.

There is also a subtler trap: confusing the appetite you state with the appetite you actually live by. Many organisations declare a low appetite for risk yet routinely accept exceptions, defer remediation and tolerate known gaps. If your real behaviour consistently contradicts your stated appetite, the statement is fiction. Use your exception register and your list of accepted risks as a reality check. If they are full of items that breach your stated tolerance, either your appetite is more open than you admit, or your controls are not keeping pace, and either way leadership needs to know.

Getting it right

Well-defined risk appetite and tolerance turn cybersecurity from a series of ad hoc judgement calls into a coherent, accountable discipline. They give the board a clear position to stand behind, give the security team an objective basis for prioritisation, and give auditors evidence of genuine governance.

Facilitating that conversation between a technical team and a board is a specialist skill, and it is one of the most common reasons organisations bring in outside help. CISO Advisory works with Australian boards and executives to set appetite and tolerance that are practical and defensible. If you would like a hand running that workshop, call 07 2112 8502 or get in touch.