SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-risk-appetite-definition

Which term describes the broad amount of risk an organization is willing to accept in pursuit of its mission?

Risk appetite. Risk tolerance is the acceptable variance in performance toward objectives.

Start playing free

  1. Risk appetite ✔
  2. Risk tolerance
  3. Inherent risk

Why: Risk appetite is set by senior leaders and guides strategy. Risk tolerance is narrower, usually set at program or system level, and describes acceptable variance. Example: appetite says email should be available nearly always.

Huh, didn't know that: NIST's risk appetite and tolerance definitions come from OMB Circular A-123, which adapted COSO language.

The dad joke
The CEO's risk appetite is huge. Her risk tolerance for downtime is tiny. Lunch is the other way around.
Like this card?
Play the game

References

Answer: Risk appetite. Risk appetite is set by senior leaders and guides strategy. Risk tolerance is narrower, usually set at program or system level, and describes acceptable variance. Example: appetite says email should be available nearly always.

  1. NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8286.pdf
    is the broad-based amount of risk an organization is willing to accept in pursuit of its mission/vision
    Checked 2026-10-10.
  2. NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8286.pdf
    is the acceptable level of variance in performance relative to the achievement of objectives
    Checked 2026-10-10.
  3. NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8286.pdf
    OMB again adapted the COSO language
    Checked 2026-10-10.
  4. NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8286.pdf
    Risk appetite is established by the organization's most senior-level leadership
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacySplitting a sensitive task, like creating and approving payments, among different people is called what?Security & PrivacyWhich list names all six functions of NIST Cybersecurity Framework 2.0?Security & PrivacyWhich governance document gives detailed, step-by-step instructions for carrying out a security task?

That's stuff everyone should know.