IT Risk Fundamentals

Risk acceptance is appropriate when the potential loss does not justify the cost of mitigation and the exposure is within the organization’s risk tolerance. NIST identifies acceptance, avoidance, mitigation, sharing, and transfer as risk-response options, and notes that risk acceptance is appropriate for risk within organizational tolerance.