The security manager begins developing an information security strategy and finds that the organization has never defined its risk appetite. What is the BEST course of action?
Select an answer to reveal the explanation.
Short Explanation
Risk appetite is the business saying 'this much risk is fine for what we're trying to do,' and only leadership gets to say it. If you set it yourself, you've quietly made the business's biggest risk call for them. The trap is pressing on with 'reduce everything to minimum,' which sounds safe and is ruinously expensive.
Full Explanation
Risk appetite expresses how much risk the organization is willing to accept in pursuit of its objectives, and it is the reference point for strategic security decisions, from setting the desired state to prioritizing investment and deciding which risks to treat or accept. Because it reflects business judgment about objectives, culture and stakeholder expectations, it must be set by senior management with board oversight. The security manager should therefore ask senior management to define it, facilitating the discussion with information about current risks and their potential impact. Setting a working appetite based on the security team's judgment has security making a business decision; even if refined later, early strategic choices would rest on an unauthorized basis. Adopting a peer's published statement imports another organization's objectives and tolerance for loss, which may be badly mismatched. Proceeding with the aim of minimizing every risk ignores that controls cost money and can impede the business; without an appetite, there is no way to judge when risk is acceptable, and the strategy would likely be unaffordable. Exam caveat: the security manager can propose a draft for management to review, provided management owns and approves it. Operational check: confirm a documented, approved risk appetite statement exists and is referenced in the strategy's prioritization criteria.