Risk Tolerance

From CIPedia
Jump to: navigation, search


European Definitions

Other International Definitions


Risk tolerance means the degree of exposure to security risk acceptable to policy makers/business owners. [1]

National Definitions


The willingness of an organization to accept or reject a given level of residual risk. [2]
Note: Risk tolerance may differ across an organization, but must be clearly understood by those making risk-related decisions.

Kingdom of Saudi Arabia

Risk tolerance: The acceptable variation relative to performance to the achievement of objectives. [3]


Risk Tolerance:
(a) The level of risk an entity is willing to assume in order to achieve a potential desired result;
(b) The defined impacts to an enterprise‘s information systems that an entity is willing to accept. [4]

United States

The level of risk an entity is willing to assume in order to achieve a potential desired result. [5]

Risk Tolerance: Thresholds that reflect the organization’s level of risk aversion by providing levels of acceptable risk in each operational risk category that the organization has established. [6]

Standard Definition

ISO Guide 73:2009(en)

Organization's or stakeholder's readiness to bear the risk after risk treatment in order to achieve its objectives [7]

Academic Definitions

Risk Tolerance refers to a person’s capacity to accept a certain amount of risk. [8].

Note: the concept of risk tolerance is linked to the concept of Risk Perception.

See also


  1. ITU Study Group Q.22/1 Report on Best Practices for a National Approach to Cybersecurity: A Management Framework for Organizing National Cybersecurity Efforts, ITU-D Secretariat, Geneva (2008).
  2. All Hazards Risk Assessment Methodology Guidelines 2012-2013, Public Safety Canada
  3. Cyber Security Framework Saudi Arabian Monetary Authority Version 1.0 May 2017
  5. NISTIR 7298 rev 2: Glossary of Key Information Security Terms, May 2013
  6. Cyber Resilience Review (CRR): Method Description and Self-Assessment User Guide (2016)
  7. ISO Guide 73:2009 Risk management -- Vocabulary
  8. Campbell Institute (2014). Risk perception: Theories, strategies and next steps.