ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Risk acceptance criteria describe the level of residual risk the organization is willing to live with before requiring further mitigation. NIST risk management publications state that such criteria must be derived from the enterprise's documented risk appetite and risk tolerance, typically expressed in a senior-leadership-approved statement or policy. This document sets the upper boundary for acceptable risk and therefore drives whether a given level of residual risk can be accepted. Budgetary limits, POA&M vulnerability listings, and IT operations service-level objectives may influence scheduling or prioritization, but none of them establishes the fundamental threshold of what constitutes acceptable risk for the organization.