CISM: Certified Information Security Manager

Acceptance of residual risk for a business use that does not comply with security policy requires authorization by senior business management, because that level is accountable for accepting risk to organizational operations. Security, compliance, and risk officers provide assessment, oversight, or advice rather than assuming the business risk. NIST describes authorization as a senior-official decision to explicitly accept organizational risk.