Cyber Risk Appetite Statement Template

Part 1 — How to set your cyber risk appetite

A risk appetite statement says how much cyber risk [[Organisation Name]] is willing to take, and where it stops. Most statements fail because they stay abstract: "we have a low appetite for cyber risk" cannot be tested, so it never changes a decision. This template ties each category of risk to a band on the same 4 × 4 scale the risk register uses, so that every quarter the statement can be tested against every risk in the register, and the answer — within appetite, or not — is a count, not an opinion.

The scale, the bands and the rules are in the Risk Assessment Methodology & Scoring Model; the Risk Identification & Assessment Operating Procedure governs how risks reach the Information Security Risk Register. This template sets the appetite those risks are tested against (RM-05).

Appetite and tolerance

• Appetite is the highest residual band the organisation accepts without escalation. A risk at or below it is managed by its owner and reviewed every quarter (RM-09).
• Tolerance is the highest band the organisation will tolerate for a time, while a plan brings the risk back within appetite. A risk above it has gone past the point at which the board said it must act, not just be told.

Both are set per category, in bands of the residual score: the score after existing controls (RM-03). Setting them in bands, not words, is what makes them testable. The three positions a risk can be in are the same words the board report uses (P03): Within appetite; Outside appetite, within tolerance; Outside tolerance.

Who decides

The appetite is set and approved by the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. In a DORA financial entity the management body bears the responsibility for setting and approving the digital operational resilience strategy, including the risk tolerance level for ICT risk (Article 5(2)(d)), so it approves the appetite and tolerance itself. Executive management proposes it, head of information security drafts it from the register, and each category owner — the executive who owns that kind of risk — agrees the level for their category before it goes to that body. Security does not set the appetite: it is a business decision about how much harm the organisation will risk for its objectives (ISO/IEC 27001 Clause 5.1, leadership and commitment).

• NIS2 essential and important entities: the management body must approve the cybersecurity risk-management measures and oversee how they are implemented. An appetite approved by the board is the clearest evidence that the management body has set the level of risk those measures must achieve.
• DORA financial entities: the ICT risk-management framework (DORA Article 6(1)) includes policies that must indicate the approval of the risk tolerance level for ICT risk (RTS 2024/1774 Article 3(a)). The Approval block in Part 2 records it: the approving body, the date, the minute, and that the tolerance bands were approved, not only the words.

The three appetite levels

Each category takes one of three levels. The level sets both bands; nothing else needs to be decided per category. Critical is never within tolerance at any level.

Note that at Open the appetite and the tolerance are the same band (High): an Open category has no "outside appetite, within tolerance" position, and a risk that leaves its appetite is already outside tolerance. Use Open only where the board is content to go straight from "note" to "decide".

What each level allows

The bands are easier to agree when they are read on the scale. For each impact level, this table shows the highest likelihood at which a risk is still within appetite (impact × likelihood, residual; bands Low 1–3, Medium 4–6, High 8–9, Critical 12–16).

Likelihood is over the next 12 months: 1 Unlikely, 2 Possible, 3 Likely, 4 Almost certain. Read the table as a sentence for the board: "for customer data we are Cautious, which means we accept a severe impact only if it is unlikely, and then only if the chance is under [[5]]% a year".

The table shows bands only. For a Severe impact, RM-13 also applies at every level, Open included. A residual Severe impact (impact 4) is also decided by its chance, whatever its score or band. At [[5]]% a year or more, executive management must accept it. At Possible or above, only the board or its equivalent may accept it. Below [[5]]% a year the band decides. If the chance is not recorded, use the higher. This adds to RM-04 and RM-08 and never replaces them. Unlikely is split in two (under [[5]]%, and [[5]]% to [[20]]%) as a note for this rule and for appetite; it is not a fifth likelihood score.

Choosing a level for each category

The template starts with six categories, the ones the pack's example uses. Rename, merge or add categories to match your business, but keep few enough (usually five to eight) that the board can hold them in mind, and give every risk in the Information Security Risk Register exactly one category.

1. Start from the register, not from a blank page. List the current top risks in each category with their residual scores. The appetite discussion is then about real risks: "are we content to carry R-05 at this score?"
2. Ask each category owner the business question. Which harm in this category would the board not accept, even for a clear benefit? Use the impact areas in the methodology — money, service, data, legal, reputation — so the answer is in the same terms the scores use.
3. Choose the level from the answer. Averse where the harm is unacceptable at almost any likelihood (typically legal and regulatory duties); Cautious where some risk buys a clear benefit; Open only where the organisation deliberately trades risk for opportunity.
4. Test the draft against the register before approval. Apply the test below to every current risk. If the draft statement puts most of the register outside appetite, either the level is not what the board will fund, or the scores are wrong; resolve which before approving. If it puts nothing outside appetite in a category the board worries about, the level may be too loose.
5. Write one sentence per category in business words (Part 2, "In words"), and check it says the same as the bands.

Measurable limits

A level and a band are tested against the register, and the register is kept by the people the appetite polices. So every category also needs at least one limit that is measured somewhere else. A limit is either an amount in euros that the organisation will not lose or spend on one event, or a key risk indicator (KRI): a measure that moves before the loss does, with a number at which the limit is breached.

• Choose the limit from the harm the category owner named, not from the data that is easy to get.
• Write the number at which the limit is breached, and the source. A limit without a number is a wish.
• A breached limit is reported with the register test and is a trigger for the owner to reassess the related risks (RM-10). It does not change a risk's position by itself.
• Set limits and levels together. If a limit is breached while every register risk in the category is within appetite, one of them is wrong.

How a level becomes a test against the register

Each risk's residual band is compared with its category's appetite and tolerance, giving its position in words. (RM-05). For each risk in the register:

1. Take its residual score and band from the register (RM-03, RM-04).
2. Look up its category's level, and from the level its appetite and tolerance bands.
3. If the residual band is above the tolerance band, the risk is Outside tolerance.
4. Otherwise, if it is above the appetite band, it is Outside appetite, within tolerance.
5. Otherwise it is Within appetite.

Count the risks outside appetite, and of those the risks past tolerance: that pair is RMM-01, risks outside appetite and past tolerance — the same figure as the board measure BM-01 in the Board Metric Selection Catalogue (P03). The organisation's own position follows from its risks' positions (the P03 rule): outside tolerance if any top risk is past its own tolerance limit; otherwise Outside appetite, within tolerance if any top risk is above appetite; otherwise Within appetite.

For example, the example organisation's R-01 (ransomware takes online ordering offline for more than 2 days) scores 4 × 2 = 8, High. Its category, Service availability, is Cautious: appetite Medium, tolerance High. High is above Medium and not above High, so R-01 is outside appetite, within tolerance.

Outside appetite, outside tolerance: what happens

The position decides what must happen next, who may accept the risk instead of treating it, and who is told when.

Accepting a risk outside appetite does not bring it within appetite. It stays counted in RMM-01 until its residual score falls, or the board changes the appetite; the acceptance is recorded on the Risk Acceptance Form & Approval Record with its conditions and review date. Critical residual risk is outside tolerance at every level, so it is always the board's decision; its acceptance is reviewed within 3 months.

Reviewing and changing the statement

Review the statement at least every [[12]] months, with the yearly reassessment of the register (RM-09), and sooner after:

• A change in strategy, such as a new market, product, acquisition or major outsourcing
• A major incident, or a risk found outside tolerance
• A change in law or regulation that changes what the organisation must not accept
• The quarterly test showing the same category outside appetite for [[two]] quarters in a row

Changing a level is a board decision, recorded with its reason. Raising the appetite for a category to bring a risk back within it is a legitimate choice — P03 lists it as one of the board's options when a risk is outside tolerance — but it must be made openly, as a decision, never as a silent edit to the register or to this statement.

Before you send it for approval

• Every [[placeholder]] is replaced and every guidance box deleted.
• Every category has one level, and its appetite and tolerance bands are the ones that level sets.
• Every risk in the register has exactly one category in this statement.
• The draft has been tested against the current register, and the result — how many risks in each position — goes to the board with it.
• Each category owner has agreed their category's level and sentence.
• The Approval block names the body, the date and the minute, and records that the tolerance bands were approved.

Part 2 — The statement template

Our overall statement

[[Organisation Name]] takes cyber risk in pursuit of [[its strategy, in a few words: e.g. growing its online services]]. It accepts [[a moderate]] level of cyber risk where there is a clear business benefit and the risk is controlled, and it does not accept [[the harms it will not accept, in business terms: e.g. a core customer service stopped for more than 2 days, or customer personal data exposed at scale]].

A residual risk in the Critical band (12–16) is never within tolerance in any category: the [[Board]] decides whether it is treated or accepted, and reviews any acceptance within 3 months. Where a risk goes above the appetite set below, it is treated or accepted at the level this statement sets; where it goes above the tolerance, the [[Board]] decides.

The appetite levels we use

Each category below has one of three levels. A level sets two bands on the Risk Assessment Methodology & Scoring Model's 4 × 4 scale: the appetite (the highest residual band [[Organisation Name]] accepts without escalation) and the tolerance (the highest band it will tolerate while a plan brings the risk back). Critical is never within tolerance.

Appetite and tolerance by category

Set one level for each category. The bands follow from the level: copy them from the table above.

In words. One sentence per category, saying what the organisation will and will not accept:

RC-01 Service availability. [[What we accept, and what we will not accept, in one sentence — in terms of services, customers, money or law]]

RC-02 Customer and personal data. [[What we accept, and what we will not accept, in one sentence — in terms of services, customers, money or law]]

RC-03 Financial fraud. [[What we accept, and what we will not accept, in one sentence — in terms of services, customers, money or law]]

RC-04 Regulatory compliance. [[What we accept, and what we will not accept, in one sentence — in terms of services, customers, money or law]]

RC-05 Third-party dependency. [[What we accept, and what we will not accept, in one sentence — in terms of services, customers, money or law]]

RC-06 People and insider. [[What we accept, and what we will not accept, in one sentence — in terms of services, customers, money or law]]

Measurable limits

Give each category at least one limit: an amount in euros, or a key risk indicator (KRI) with the number at which it is breached. The source must not be the register.

How this statement is tested

Every quarter, head of information security compares each risk in the Information Security Risk Register with its category's row above (RM-05): a risk whose residual band is above the category's appetite is outside appetite; above its tolerance, outside tolerance. The number of risks in each position is reported as RMM-01, risks outside appetite and past tolerance.

Every quarter, the owner of each category reports its limits from the sources named above. A breached limit is reported with RMM-01 and is a trigger for reassessing the related risks (RM-10). It does not change a risk's position by itself.

When a risk is outside appetite or tolerance

• Outside appetite, within tolerance: a treatment decision within [[30]] calendar days of the risk first being assessed outside appetite (RM-06); acceptance needs, beyond the approvers for its band, at least executive management [[e.g. the Executive Committee]]; reported to executive management every quarter and in the next board report.
• Outside tolerance: reported to the chair of the [[Board]] within [[5]] working days; only the board or its equivalent may accept it (RM-08), and it decides whether to fund treatment, accept the risk, or change this statement.
• A Severe impact, in any position and any category: at [[5]]% a year or more, executive management [[e.g. the Executive Committee]] must accept it; at Possible or above, only the board or its equivalent may (RM-13).

Review

This statement is reviewed at least every [[12]] months, and sooner after [[the triggers in Part 1]]. A change to a level or a band is approved by the [[Board]], and recorded with its reason.

Approval

Part 3 — Worked example

This is the completed statement of the fictional example organisation used across the Information Security Risk Management pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. The levels are the example levels of the six categories; the register it is tested against is the example Information Security Risk Register, as at 2026-09-30 (the end of Q3 2026). The same organisation and quarter appear in the P03 board reporting pack.

Our overall statement

We take cyber risk in pursuit of growing our online ordering service. In five of our six categories we are Cautious: we accept some risk for a clear business benefit, with controls. In regulatory compliance we are Averse: we avoid this risk and act on anything above Low. (EXAMPLE)

A residual risk in the Critical band is never within tolerance in any category: the Board decides whether it is treated or accepted, and reviews any acceptance within 3 months. Where a risk goes above the appetite set below, it is treated or accepted at the level this statement sets; where it goes above the tolerance, the Board decides. (EXAMPLE)

The appetite levels we use

Each category below has one of three levels. A level sets two bands on the Risk Assessment Methodology & Scoring Model's 4 × 4 scale: the appetite (the highest residual band the Company accepts without escalation) and the tolerance (the highest band it will tolerate while a plan brings the risk back). Critical is never within tolerance.

Appetite and tolerance by category

EXAMPLE. The level, bands, test and owner for each category.

In words. One sentence per category, saying what the organisation will and will not accept:

RC-01 Service availability. We accept a short stop of an internal service. We accept the ordering service being down for up to 2 days only if that is no more than Possible. We do not accept it being down for longer unless that is under 5% a year; from 5% the Executive Committee must accept it, and from Possible only the Board. (EXAMPLE)

RC-02 Customer and personal data. We accept the loss of internal confidential data, and the exposure of customer data of a few hundred people only if that is no more than Possible. We do not accept a notifiable breach of customer data at scale unless it is under 5% a year; from 5% the Executive Committee must accept it, and from Possible only the Board. (EXAMPLE)

RC-03 Financial fraud. We accept a payment loss of up to €1,000,000 only if it is no more than Possible. We do not accept a larger loss unless it is under 5% a year; from 5% the Executive Committee must accept it, and from Possible only the Board. (EXAMPLE)

RC-04 Regulatory compliance. We accept a formal enquiry by a regulator or a customer, or a contract breach with penalties, only if it is unlikely. We treat a notifiable breach, enforcement action or the loss of a contract at any likelihood. (EXAMPLE)

RC-05 Third-party dependency. We accept a supplier failure that degrades one of our services for up to 2 days only if that is no more than Possible. We do not accept a supplier failure that stops a core service for longer unless it is under 5% a year; from 5% the Executive Committee must accept it, and from Possible only the Board. (EXAMPLE)

RC-06 People and insider. We accept a staff mistake or the misuse of an account that affects internal data or an internal service for hours. We do not accept misuse that stops a core service or exposes customer data at scale unless it is under 5% a year; from 5% the Executive Committee must accept it, and from Possible only the Board. (EXAMPLE)

Measurable limits

EXAMPLE. At least one limit for each category, measured from a source other than the register.

How this statement is tested

Every quarter, the Head of Information Security compares each risk in the Company's risk register with its category's row above (RM-05). The number outside appetite, and of those past tolerance, is reported to the Executive Committee and the Board as RMM-01 (the Board's BM-01). (EXAMPLE)

The limits in the table come from sources outside the register: the recovery tests, the vulnerability tracker, the incident log, the finance loss log and the third-party register. A limit is not a second position test. A category can be within appetite while a limit is breached, and the board report says so. (EXAMPLE)

When a risk is outside appetite or tolerance

• Outside appetite, within tolerance: the risk owner brings a treatment decision within 30 calendar days of the risk first being assessed outside appetite; later reviews do not restart the clock (RM-06). Acceptance needs, beyond the approvers for its band, a decision of the Executive Committee. Reported to the Executive Committee every quarter and in the next Board report. (EXAMPLE)
• A Severe impact, in any position and any category: at 5% a year or more, the Executive Committee must accept it; at Possible or above, only the Board may (RM-13). (EXAMPLE)
• Outside tolerance: reported to the Chair within 5 working days. Only the Board may accept it (RM-08); it decides whether to fund treatment, accept the risk, or change this statement. (EXAMPLE)

Review

Reviewed every 12 months, at the Board's January meeting, and sooner after a change in strategy, a major incident, a risk outside tolerance, or a change in law. Next review by 2027-01-29. (EXAMPLE)

Approval

Tested against the register

EXAMPLE, as at 2026-09-30. Every top risk in the example register, with its residual score (impact × likelihood), band, its category's level and the position the test gives.

EXAMPLE result by category:

Result: 2 of 12 top risks outside appetite, none past tolerance (RMM-01). The Company's position is therefore Outside appetite, within tolerance — the opening sentence of its Q3 2026 board report (P03). (EXAMPLE)

Movement. R-04 (ransomware spreads from warehouse office PCs to warehouse systems) was 3 × 3 = 9, High, last quarter — outside the Cautious appetite for service availability — and is now 2 × 2 = 4, Medium, after the warehouse network was separated from the office network. (EXAMPLE)

What follows for the two risks outside appetite. Each has a treatment decision (RM-06) and an action expected to bring it back within appetite (EXAMPLE):

R-01's action, TA-01, is the decision the Board is asked to take in the Q3 2026 report. Neither risk is accepted. Accepting R-02 (High, outside appetite, within tolerance) would need the accountable executive and Head of Information Security, and executive management as well: here, the Executive Committee. Accepting R-01 would need the Board, because its impact is Severe at Possible: accountable executive and Head of Information Security recommend; only the board or its equivalent may accept (RM-13). Both would still count as outside appetite. (EXAMPLE)

The one accepted risk in the register, R-12 (customer data on an unencrypted laptop at the smaller warehouse site is lost or stolen), is Medium and within the Cautious appetite for customer and personal data, so its band's approvers were enough: Head of Logistics (risk owner) and Head of Information Security, on 2026-06-15, for review within 12 months. It is recorded on the Risk Acceptance Form & Approval Record. (EXAMPLE)

Related documents

Adapting this template

Framework references

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR).

Definitions