What it asks for. This Govern category requires the organisation to establish, communicate and use its priorities, constraints, risk tolerance and appetite statements and assumptions to support operational risk decisions. Cybersecurity risk should be part of enterprise risk management.
In practice. Good practice is a documented cybersecurity risk management strategy approved by senior leadership, with clear risk appetite statements, consistent methods for assessing and prioritising risk, and defined criteria for accepting, mitigating, transferring or avoiding it. Cyber risks appear in the enterprise risk register with owners. Evidence includes the strategy, appetite statements, risk register entries and decisions on risk acceptance.
Common gaps. Risk appetite is often stated in vague terms that cannot guide decisions. Cyber risk is commonly managed in a separate silo from enterprise risk, so the board sees technical findings rather than business exposure.