Risk acceptance acknowledges a risk and deliberately takes no additional mitigation action. Organizations may choose it when treatment costs exceed expected risk reduction or when the risk fits defined tolerance levels. section 5.3.1 section 8.1.3
A responsible acceptance decision should:
- Assess the risk’s potential effect and threat likelihood before deciding. section 8.1.3
- Compare mitigation, transfer, or avoidance costs with the potential detrimental effects. section 5.3.1 section 8.1.3
- Monitor the risk so that changing conditions do not push it beyond acceptable limits. section 5.3.1 section 8.1.3
Cost-versus-effect decision
An organization assesses a risk, determines that additional mitigation would cost more than the expected reduction in harm, and accepts the risk while monitoring its effect and likelihood. section 5.3.1 section 8.1.3
