A security risk appetite statement is a short document, usually one page, that says how much cyber risk leadership is willing to accept in pursuit of its goals, in terms that let teams decide. Write it with executives, use concrete limits instead of adjectives, and review it once a year.
Why most appetite statements fail
Most say something like "the company has a low appetite for cyber risk." That sentence cannot settle an argument. A product manager who wants to ship with a known medium issue cannot tell whether low appetite means no or yes.
A usable statement answers specific questions. How long may a critical flaw stay open on an internet-facing system? Can a customer data store go without encryption? Who may sign off on an exception?
A structure that works
Use five short parts.
- Scope. Which systems, data and business lines it covers.
- Categories. Pick four to six, such as customer data, availability, regulatory exposure, third parties and financial loss.
- Statement per category. One sentence in plain words, such as "We will not store unencrypted customer personal data in any environment."
- Tolerances. A number or yes/no limit that can be checked, such as "critical issues on internet-facing systems are fixed within a window that the board has approved."
- Escalation. Who can accept risk above the line, and who must be told.
Keep the whole thing to a page. If it needs two, the categories are too many.
How to set the numbers
Do not invent limits in a room of security people. Ask the owners of revenue, legal and operations what they could not live with. Common prompts are an outage of a day, a breach that triggers customer notification, or a contract loss.
Then compare your current state with the draft limits. If today's reality is far outside them, you have found your roadmap. Say so openly, and attach a date by which the gap will close.
Link it to daily work
Appetite only matters if it shapes decisions. Tie each tolerance to something you already track, such as fix times, exception requests or open audit findings. When a metric crosses a limit, it should trigger a named action rather than a discussion.
The NIST risk assessment guidance describes assessment results as the information senior leaders need to choose responses to risk. An appetite statement is the other half: it tells them where the line sits before the results arrive.
Quick check
Who approves a risk appetite statement?
The executive team or board, depending on your governance. Security drafts it, but the business must own the limits.
How often should it be reviewed?
At least yearly, and after a major incident, acquisition or change in business model.
Sources
Last reviewed: 19 October 2026.
