Risk appetite is the amount and kind of risk an organization is willing to accept while pursuing its goals. It is a strategic decision owned by executive leadership and the board, not something a technical team sets on its own. An aggressive fintech startup and a federal healthcare agency will land in very different places, and both can be right for their context.
People often confuse risk appetite with risk tolerance. Appetite is the broad target; tolerance is the acceptable variation around it. If a company accepts up to one million dollars in annual security losses, its tolerance might permit swings between eight hundred thousand and 1.2 million before anyone escalates. The practical failure to avoid is leaving appetite vague, because a statement nobody can measure gives teams no real guidance when they weigh a control against its cost.
Why does risk appetite matter for the CISSP exam?
Risk appetite is foundational in Domain 1: Security and Risk Management. Candidates should understand how it flows down from governance into concrete control requirements, and how it interacts with residual risk once treatments are applied.
Related terms: Risk Management, Residual Risk