ISO 27001 asks an organization to define its risk acceptance criteria up front, in clause 6.1.2, and then to obtain the owners' approval of the residual risks under 6.1.3. Accepting a risk is legitimate when the cost of treatment outweighs the exposure, as long as the decision is deliberate, recorded and revisited when the risk changes.
An unrecorded acceptance looks, to an auditor, like a risk nobody noticed. See residual risk.
Read more
Related terms
- Residual risk
- Residual risk is the level of risk that remains after the planned treatment and controls have been applied, which the risk owner must formally accept.
- Risk owner
- A risk owner is the person with the accountability and authority to manage a particular risk, including approving its treatment and accepting what remains.
- Risk treatment plan
- A risk treatment plan is the ISO 27001 document recording how each information security risk will be treated, by whom, by when and with which controls.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.