RSK-04 · Risk and Decisions
Appetite and indicators
Risk appetite is stated in terms someone can measure, with indicators and thresholds that trigger action.
2frameworks fully address it
3partially
3leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2PartialCC3.1 Objectives and tolerances are required; appetite language is not.
- ISO 27001Partial6.1.2(a) Risk criteria including acceptance criteria.
- NIST CSFFullGV.RM-02
- PCI DSSAbsent Prescriptive standard; no appetite concept.
- HIPAAAbsent No appetite concept in the Security Rule.
- GDPRAbsent Risk is assessed against individuals' rights, not against an organizational appetite.
- EU AI ActPartialArt. 9(5) Residual risk must be judged acceptable.
- NIST AI RMFFullGOVERN 1.3
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Appetite statement, KRI definitions, threshold breach records.
?Why it exists
Appetite that cannot be measured cannot be exceeded, so it is never discussed.
For a smaller organizationThree indicators leadership actually watches.