How much cyber risk is your organisation willing to accept?
Someone in your organisation is deciding how much cyber risk is acceptable. If your leadership team has never discussed it, that person may be you.
Every time you choose what to fund, what to defer, which supplier risk to accept, or which system limitation to live with until next year, you’re making a judgement about how much cyber risk the organisation is prepared to carry. That is a lot of judgement to be carrying quietly, and most of the people carrying it have never been told that’s what they’re doing. It usually arrives with everything else, in week someone has been handed the problem.
The answer isn’t to stop making those decisions.
It’s to make sure the decision about how much risk is acceptable sits with the people who are supposed to make it, so that you’re applying a position rather than it being made by default.
What is cyber risk appetite?
Risk appetite is simply the amount and type of risk an organisation is prepared to accept while pursuing its objectives. It isn’t a judgement about whether something is completely safe, because almost every useful technology decision involves some risk. The important distinction is who makes the call.
The person responsible for cyber security identifies the risk, explains the consequences and recommends a position. Leadership then decides, within its authority, with the governing body approving the organisation’s overall appetite where appropriate. That split is the whole argument, and it gives everyone something consistent to work from.
Without it, the decisions still happen. They’re simply made one at a time, often by different people, using different assumptions, and nobody discovers they disagreed until something has already gone wrong.
Bring a draft, not a question
Don’t put an agenda item in front of leadership called “Cyber risk appetite” and ask them what they think. It’ll be deferred, politely, and probably more than once. Bring them something to react to instead. This is the single most useful thing we can tell you about getting this decided: people who won’t produce a position from nothing will happily improve one that’s already on the page.
Proportionality matters here too. With no security team, no budget for this work, potentially one IT contractor and a board that meets six times a year, it’s reasonable to assume risk appetite is something only larger do. It isn’t. The frameworks arriving from central agencies unfortunately assume resources you probably don’t have, but the decision underneath them is the same at forty staff as at four hundred, and at your size it fits on one page.
For a smaller health, NGO or community organisation, a first draft could be as simple as four levels.
A risk appetite statement example you can adapt
Take the wording below, change what doesn’t fit and delete what doesn’t apply. It’s a starting position, not a template to be admired.
Higher appetite
We will accept some additional cyber risk where it enables genuine service innovation, provided the risk is understood, proportionate and reversible.
This might apply when you’re trialling new technology or a new way of delivering a service, where the consequences of it not working are manageable. Without this, security becomes the reason nothing gets tried, and you don’t want that when you need to be improving and innovating.
Moderate appetite
We accept normal managed risk from cloud services, remote working and everyday technology, where appropriate security and recovery arrangements are in place.
The aim is not to eliminate all risk from normal operations, which isn’t possible anyway. It’s to understand and manage it, and to know which of the suppliers who can reach your data you’re relying on to hold up their end.
Low appetite
We have a low appetite for risks affecting patient, client, donor, employee or other sensitive information, and for prolonged disruption to important services.
Low appetite doesn’t mean unlimited spending. It means these risks deserve stronger controls and should be escalated when they cannot be adequately treated. In New Zealand, this carries a statutory edge as well as an ethical one: under the Privacy Act 2020 you have to notify the Office of the Privacy Commissioner, and the people affected, of a privacy breach likely to cause serious harm. This is worth mentioning when you put the draft up.
No or near-zero appetite
We have no appetite for knowingly operating a critical service without a viable recovery path, or for knowingly leaving privileged access or unsupported critical systems uncontrolled.
This doesn’t promise that an incident will never happen, because no statement can. It says there are conditions the organisation is not prepared to knowingly tolerate. The word doing the work is “knowingly”, and it’s what makes the statement testable: either you know the state of your recovery path and your privileged accounts, or you’ve just found your first gap.
What changes when you write it down?
The point of risk appetite is not the document. It’s the decisions that change because of it.
In one organisation we worked with, limited cyber security funding had already been earmarked for a new firewall. It was a reasonable choice and nobody had made a mistake. At the same time, active attacks were succeeding against similar organisations, and staff behaviour was an important part of how those attacks worked. The organisation’s security awareness capability was not strong enough.
Once the available budget was set against the risks that most needed reducing, the priority changed. Funding intended for the firewall was redirected into staff cyber security awareness training instead. The firewall wasn’t cancelled; it moved down the roadmap, and that distinction matters.
Both investments had value. The question was not whether staff training is “better” than a firewall. It was which investment reduced the most relevant risk first with the money available. The roadmap then showed leadership what was being funded now, what had been deliberately delayed, and why. That is risk appetite becoming useful rather than sitting in a folder being a policy.
How do you get leadership to make the decision?
You need to make the decision easy to understand. A one-page proposal is usually enough.
For each major risk area, show:
The proposed appetite
What that means in practical terms
The most relevant current risk
What you recommend doing about it
What decision you need from leadership
Four statements is usually enough. More than that and you’re asking for a workshop rather than a decision. Filled in, they look something like below. The risks named are illustrative, so use your own.
Sensitive client information - Low appetite
We expect strong authentication, controlled access, supported systems and recoverable data. Where an important system cannot meet those expectations, the risk needs treatment or explicit escalation. Current risk: our practice management system doesn’t support multi-factor authentication for all users. Recommendation: raise it with the vendor at renewal, restrict access meanwhile. Decision needed: agreement to accept the restriction until the vendor can support it.
Service continuity - No appetite
We will not knowingly operate a critical service without a recover path that someone has tested. Current risk: we take backups of all critical systems and we’ve never restored one. Recommendation: test a restore of the two systems we can’t operate without, this quarter. Decision needed: approval of the time it takes, and of a short, planned outage to do it properly.
Suppliers and cloud services - Moderate appetite
We accept normal managed risk from established providers, where we know what they hold and what happens if they fail. Current risk: we can’t list every supplier who can reach our data. Recommendation: build the list, then question the three most critical. Decision needed: none yet, for noting. We’ll bring the results back.
New technology and service innovation - Higher appetite
We will trial new tools where the risk is understood, proportionate and reversible. Current risk: staff are already using AI tools we haven’t assessed. Recommendation: list what’s in use, set a short position on what can go into them. Decision needed: who owns that position and reviews it.
Leadership can disagree with any of your recommendations, and that’s fine. That’s the outcome working. The important thing is that the decision is now visible and being made at the right level.
Five signs your risk appetite is not aligned
If you’re not sure whether this is a problem in your organisations, these are the warning signs we see most often:
Strategy encourages something that security routinely blocks
Compliance gets funded while more significant operational risks remain untreated
Similar risks get different decisions depending on who raises them
Cyber spending does match the risks leadership says matter most
Significant security issues repeatedly arrive as surprises
None of these mean anyone is doing a bad job. They’re what happens when an organisation has never translated its broad attitude to risk into practical decisions that people can apply.
What changes once it is agreed?
The everyday questions become easier. Should this control be funded now or next year? Should this system be replaced? Is this supplier risk acceptable? Does this issue need to be escalated, or can it be managed operationally? Judgement is still required, but you’re no longer starting from nothing each time. It also changes what the report your leadership team sees is for: instead of describing activity, it can show where the organisation sits against a position it agreed to.
Most importantly, the person who has been handed responsibility for cyber security no longer has to carry every decision alone. Your job is to make the risk visible, recommend a position and explain the consequences. Leadership’s job is to make the call. Once that happens, the cyber security roadmap can follow the risks the organisation has actually chosen to reduce, rather than becoming a list of everything that could possibly be improved.
Where a fractional CISO earns their place is in having sat through enough of these to know which statements a leadership team will genuinely argue about, and in being independent enough to recommend a position that costs money without anyone wondering whether we’re selling something.
That is what a useful cyber risk appetite gives you: clearer decisions about which risks to reduce, which to accept, and when to escalate.
Not sure where your risks actually sit? Download the 10 questions every health leader should be asking about cyber risk checklist, or get in touch to have a chat about how our Fractional CISO service could help.
