Does your organization have a formal process to periodically review and update its risk appetite and objectives based on current risk exposure and residual risk levels?
Explanation
Risk appetite is rarely static, and reviewers want to know whether your organization formally reviews and updates it and its objectives in light of current exposure and residual risk.
As business conditions, technologies, and threats evolve, organizations need to recalibrate their risk appetite to ensure security controls remain aligned with business priorities and acceptable risk levels.
Without this periodic refinement, security controls may become misaligned with actual business needs or fail to address emerging risks adequately.
Evidence of compliance could include documented risk appetite statements with revision history, minutes from risk committee meetings showing periodic reviews, formal reports comparing actual risk exposure against defined thresholds, or updated risk management policies with approval dates and signatures from executive leadership.
Implementation Example
Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk
ID: GV.RM-02.017
Context
- Function
- GV: GOVERN
- Category
- GV.RM: Risk Management Strategy
- Sub-Category
- Risk appetite and risk tolerance statements are established, communicated, and maintained
Related questions
- Does your organization update cybersecurity risk management objectives as part of annual strategic planning and when significant organizational or environmental changes occur?
- Has your organization established measurable objectives for cybersecurity risk management?
- Have senior leaders established and agreed upon measurable cybersecurity objectives that are used to manage risk and evaluate performance?
- Has your organization formally defined and communicated risk appetite statements that clearly articulate acceptable levels of risk across different business areas?
- Has your organization translated high-level risk appetite statements into specific, measurable risk tolerance metrics that can be monitored and reported?
- Does your organization integrate cybersecurity risk management into its enterprise risk management framework?