GV.RM-02 says risk appetite and risk tolerance statements are established, communicated and maintained. Appetite is how much risk leadership is willing to take in pursuit of goals. Tolerance turns that into limits people can check against.
What good looks like
A one page statement leaders actually wrote, with appetite in plain words and tolerance as numbers or clear thresholds. Teams use it when deciding to fix, accept, transfer or avoid a risk. It is refreshed as exposure changes.
How to implement it
- Ask leaders a few direct questions. How much downtime is acceptable? What loss of customer data would end a relationship? How much money could one incident cost before it threatens the plan?
- Write appetite statements, for example "we accept low risk for customer data and moderate risk for internal tools".
- Translate them into tolerances: a maximum recovery time, a maximum days to patch critical issues, a cap on financial loss per incident.
- Share them where decisions are made, such as the risk register and procurement checklist.
- Refine periodically against known exposure and residual risk.
Evidence to collect
- The signed or approved appetite and tolerance statement with a date.
- Risk register entries that cite a tolerance when accepting or treating a risk.
- Review records showing the statement was updated.
Common gaps
- Appetite is a slogan, such as "low", with no thresholds behind it.
- Tolerances never reach the people accepting risks day to day.
- Nobody revisits the statement after a growth spurt or an incident.
Quick check
Can appetite just be a sentence?
The sentence is fine as a start. Add tolerances with numbers or thresholds so teams can tell whether a risk is inside or outside the line.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.RM-02: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
