Risk Tolerance
What is Risk Tolerance?
The acceptable level of variation an organisation is willing to tolerate around specific risk objectives. Risk tolerance provides specific, measurable thresholds that translate the broader risk appetite into operational guidance.
Terms that appear alongside risk tolerance
Each of these is named in at least one of the same controls as risk tolerance. The number is how many controls name both.
- risk appetite 10 shared controls
- nist 10 shared controls
- accountability 6 shared controls
- governance 6 shared controls
- audit 5 shared controls
- cybersecurity 5 shared controls
- policy 5 shared controls
- availability 4 shared controls
Frameworks that govern risk tolerance
What the standards actually require on risk tolerance
Requirements naming risk tolerance across 6 standards, quoted from the control text.
Organizational risk tolerances are determined and documented. Tolerance is written down at a level that lets someone decide whether a measured risk is acceptable, and it is traceable to an authority that can set it.
AIRMF-MP-1.5 · Organizational risk tolerances are determined and documented →The plan must require that enterprise risk tolerance is taken into account when the IAC risk management strategy records the IAC risk tolerance, that IAC risk tolerance is approved by defined stakeholders, and that tolerance is specified for Baseline Profile s...
api-1164::ID.RM-2 · ID.RM-2 Risk tolerance documented, approved and set per profile →Requirement 0036 (Part Two: Risk, section 5.1 Security Risk Management; applies to All entities; dated 31 October 2024; retained from Release 2025): The Accountable Authority determines their entity's tolerance for security risks and documents in the security...
protective-security-policy-framework-pspf-release-2026::0036 · 0036 Determine and document security risk tolerance →Organizational risk tolerance is determined and clearly expressed. IDENTIFY (ID) Function, Risk Management Strategy (ID.RM) Category. Outcome in the Framework Core of Version 1.0; unchanged in Version 1.1.
nist-cybersecurity-framework-1-0::ID.RM-2 · ID.RM-2: Organizational risk tolerance is determined and clearly expressed →Organizational risk tolerance is determined and clearly expressed. IDENTIFY (ID) Function, Risk Management Strategy (ID.RM) Category. Outcome in the Framework Core of Version 1.1; withdrawn in CSF 2.0 (incorporated into GV.RM-02, GV.RM-04).
nist-cybersecurity-framework-1-1::ID.RM-2 · ID.RM-2: Organizational risk tolerance is determined and clearly expressed →The rule lists what makes up the profile: how old the customer is, what else they hold, their financial position and needs, their tax position, what they are trying to achieve, how experienced they are, how long they can invest, how much liquidity they need, h...
finra-rule-2111-suitability-united-states::2111a-profile · Collect and analyse the customer investment profile: age, other investments, financial situation, tax status, objectives, experience, horizon, liquidity, risk tolerance →Questions people ask about risk tolerance
What is Risk Tolerance?
Why is Risk Tolerance important for compliance?
Which compliance frameworks address Risk Tolerance?
Where can I learn more about Risk Tolerance?
See how Risk Tolerance applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.