Risk Acceptance
What is Risk Acceptance?
A conscious decision to acknowledge and tolerate a specific risk without additional mitigation when the cost of treatment exceeds the potential impact.
Terms that appear alongside risk acceptance
Each of these is named in at least one of the same controls as risk acceptance. The number is how many controls name both.
- residual risk 15 shared controls
- risk assessment 8 shared controls
- risk treatment 8 shared controls
- vulnerability 6 shared controls
- governance 5 shared controls
- policy 5 shared controls
- nist 4 shared controls
- risk register 4 shared controls
Frameworks that govern risk acceptance
What the standards actually require on risk acceptance
Requirements naming risk acceptance across 6 standards, quoted from the control text.
Acceptance criteria decide in evaluation whether a risk is acceptable and in treatment whether a proposed treatment is enough or more is needed, and the organisation defines levels of acceptance.
iso-27005-2022::6.4.2 · Risk acceptance criteria →Establish Generative AI governance per NIST AI 600-1 governance actions including: dedicated GAI governance function with named accountable officer + policies covering data + model + deployment + use cases + risk acceptance and residual risk decisions document...
NISTAI600-2 · GAI Governance - Roles, Policies, and Risk Acceptance →EN 50126-2:2017 8.3.2 covers applying comparison with a similar reference system as the risk acceptance principle; the system under consideration applies the method or requirement of this sub-clause where its safety process relies on it.
en-50126-en-50128-en-50129-railway-applications-rams::50126-2:8.3.2 · Use of a reference system →A FedRAMP Authorized designation makes the package available on request to the whole federal government, but the initial agency ATO is not a government-wide risk acceptance: each subsequent agency reviews the package, determines the acceptability of the risks...
fedramp-rev-5::A.9 · A.9 Reuse: every agency issues its own authorization →Prioritise on the assessment results and set a risk treatment plan (avoid, reduce, accept, transfer); set procedures for exceptions and risk acceptance, with management approval when used;
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.2.2.3-B · 2.2.2.3 Risk treatment: basic actions →Route every deviation from security policies, instructions and the related controls through the risk management process, secure risk owner approval and residual risk acceptance, record each deviation with a defined expiry, and have risk owners reconfirm its ap...
C5-SP-03 · Exceptions from Existing Policies and Instructions →Questions people ask about risk acceptance
What is Risk Acceptance?
Why is Risk Acceptance important for compliance?
Which compliance frameworks address Risk Acceptance?
Where can I learn more about Risk Acceptance?
See how Risk Acceptance applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.