Every risk decision needs a line to be measured against. This statement gives the board one: how much cyber risk the organisation will accept in pursuit of its objectives, set by category with measurable thresholds and escalation triggers, the rules that anchor every accept / mitigate / transfer / avoid call, and a formal record for the risks the board accepts above appetite.
Educational template — not legal advice. Governance concepts are summarised for orientation; adapt this with your risk function and qualified counsel.
Free · no signup · adapt it in your own doc
Board Cyber Risk Appetite Statement
A board-approved statement of how much cyber risk the organisation is willing to accept in pursuit of its objectives. It sets appetite by category, defines the tolerance thresholds and escalation triggers management operates within, and gives the rules that anchor every accept / mitigate / transfer / avoid decision.
01Purpose & how to use this statement
This statement expresses the level of cyber risk the board is willing to accept in pursuit of the organisation’s objectives. It is a board artefact: the board (or its risk committee) approves it, and management operates within it and reports against it.
Organisation / scope
Entity or business lines this statement covers
Approving body
Board or risk committee
Effective date
Date approved
Next scheduled review
At least annual — see section 5
Appetite = how much risk the board will accept to pursue objectives (a forward-looking choice).
Tolerance = the allowable variation around appetite before escalation is triggered (the guardrail).
Every risk-treatment decision in the organisation references this statement; a risk above appetite is treated back within it or formally accepted (section 4).
Keep it specific enough to resolve a real decision. An appetite so vague it blocks nothing is a poster, not a control.
02Appetite by category
Appetite legitimately differs across categories — and may differ by business line. State each one, pair a qualitative stance with a measurable threshold, and define when management must escalate.
Category
Appetite statement (qualitative + quantitative)
Tolerance threshold
Escalation trigger
Confidentiality / data
e.g. Very low — no single risk above $X annualised loss; no acceptance of plaintext storage of regulated data
Variation allowed before escalation
Point at which management must escalate to the board
Availability / uptime
e.g. Low — critical services restored within Y hours (RTO); max Z hours unplanned downtime/quarter
e.g. RTO exceeded on a tier-1 service
e.g. any outage of a tier-1 service > Y hours
Compliance / regulatory
e.g. Near-zero for the regulated business line; no accepted known non-compliance
e.g. one minor finding open > N days
e.g. any reportable regulatory breach
Third-party / supply chain
e.g. Low — no critical dependency without assessed controls and contractual notice
e.g. a critical vendor below control baseline
e.g. a critical fourth-party concentration
Safety / physical
e.g. Minimal — no accepted risk with potential for physical harm
e.g. any control gap on a safety-impacting system
e.g. any credible safety impact
Where a business line warrants a tighter (or looser) appetite than the enterprise default — e.g. a regulated-payments unit — state it explicitly here rather than relying on one blanket figure.
03Treatment decision rules (accept / mitigate / transfer / avoid)
Every treatment decision is justified by where the residual risk sits relative to the appetite above. Appetite is the yardstick — a decision that does not reference it is unanchored.
Accept — only where residual risk is already within appetite, or the board has formally accepted the exception (section 4).
Mitigate — apply proportionate controls to pull residual risk back under the appetite line; weigh control cost against the risk (do not spend disproportionately).
Transfer — move residual exposure (e.g. insurance, contractual terms) where that is the efficient way to bring it within appetite.
Avoid — do not undertake (or exit) the activity where the risk cannot be brought within appetite at acceptable cost.
A risk above appetite is never left to sit and never silently re-baselined by raising the appetite figure. Treat it back within appetite, or record a formal board acceptance (section 4).
When a real risk exceeds appetite and is not treated back within it, the board formally accepts the exception on a time-bound basis. Record each acceptance so it is revisited rather than becoming a permanent blind spot.
Risk reference & appetite line exceeded
Register ID + which category/threshold it breaches
Residual risk (quantified where possible)
e.g. $ annualised loss expectancy after controls
Rationale for acceptance
Why acceptance is the chosen treatment — e.g. mitigation disproportionate to the risk
Accepted by
Board / risk committee — name and date
Owner
Named accountable owner
Expiry / review date
The date this acceptance must be revisited
Acceptance ties to the specific appetite line it exceeds
Rationale is documented
A named owner is recorded
An expiry / mandatory review date is set (no open-ended acceptances)
An acceptance with no rationale, owner or expiry normalises the breach and is never re-examined. Treat its absence as a governance gap.
05Review cadence & ownership
Review frequency
At least annually
Event-driven review triggers
Acquisition, new product/business line, material incident, strategy shift, regulatory change
Owner of this statement
Risk committee / CISO as custodian
Reporting cadence to the board
How often management reports performance against appetite
Reviewed and re-approved by the board at least annually.
An out-of-cycle review is triggered by any major change — do not wait for the calendar, and do not wait for a breach.
Management reports against appetite on a regular cadence, flagging any tolerance breaches.
06Board sign-off
The board (or its risk committee) approves this appetite; management operates within it. Record the approval.
Board / risk committee chair
Name / date
Chief executive
Name / date
Chief financial officer
Name / date
Chief information security officer (custodian)
Name / date
Practice the decision
This statement records calls you can rehearse. The free Risk Appetite Statement Lab puts you on the risk committee and grades you on ~14 of the exact decisions this template documents — appetite vs tolerance, qualitative vs quantitative thresholds, where to draw the accept/mitigate/transfer lines, and how to reconcile a risk that exceeds appetite.
TL;DR
What this template is
A board-ready template that records how much cyber risk the organisation is willing to accept in pursuit of its objectives — the board-approved cyber risk appetite statement.
Sections: purpose and how to use it, appetite by category (with tolerance thresholds and escalation triggers), accept/mitigate/transfer/avoid treatment rules, breach and exception handling with a formal acceptance record, review cadence and ownership, and the board sign-off block.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Risk Appetite Statement Lab.
Educational template — not legal or risk-management advice. Adapt it with your risk function and qualified counsel.
Frequently asked questions
What is this template for?+
It is a board-approved cyber risk appetite statement: a document that records how much cyber risk the organisation is willing to accept in pursuit of its objectives, expressed by category with tolerance thresholds and escalation triggers, plus the rules that anchor every accept/mitigate/transfer/avoid decision and a formal record for accepting a risk that exceeds appetite.
What is the difference between risk appetite and risk tolerance?+
Appetite is the amount of cyber risk the board is willing to accept — a forward-looking choice. Tolerance is the allowable variation around that appetite before escalation is triggered — the guardrail. Breaching tolerance is the signal that management must escalate the risk to the board.
What happens when a real risk exceeds the appetite?+
You either treat it back within appetite (mitigate proportionately, transfer the residual, or avoid the activity) or the board formally accepts the exception on a time-bound basis — with a documented rationale, a named owner and an expiry/review date. You never silently raise the appetite figure to make the breach disappear.
Is this legal advice?+
No. It is an educational template. Governance concepts are summarised for orientation and can change; adapt this with your risk function and qualified counsel and apply it to your specific facts.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout