{"id":176,"date":"2026-03-31T20:32:17","date_gmt":"2026-03-31T15:02:17","guid":{"rendered":"https:\/\/blogs.infosys.com\/cybersecurity\/?p=176"},"modified":"2026-04-10T15:31:12","modified_gmt":"2026-04-10T10:01:12","slug":"rethinking-risk-appetite-why-every-organization-needs-a-living-framework","status":"publish","type":"post","link":"https:\/\/blogs.infosys.com\/cybersecurity\/cybersecurity\/rethinking-risk-appetite-why-every-organization-needs-a-living-framework.html","title":{"rendered":"Rethinking Risk Appetite: Why Every Organization Needs a Living Framework"},"content":{"rendered":"
Introduction<\/strong><\/h6>\n

Risk appetite has quietly become one of the most misunderstood and underutilized tools in enterprise governance. For years, organizations treated it as a compliance artefact \u2014 a document created once, reviewed infrequently, and rarely connected to day\u2011to\u2011day decision\u2011making. That approach might have worked in a slower, more predictable world. It does not work anymore.<\/p>\n

At its core, risk appetite<\/strong> defines the nature and extent of risk the enterprises are willing to accept while working toward their strategic objectives. It reflects Board and Management expectations about acceptable levels of uncertainty, loss, or disruption, and provides a reference point against which decisions, investments, and tradeoffs are evaluated across the enterprise.<\/p>\n

Today\u2019s operating environment is shaped by rapid geopolitical shifts, AI\u2011driven threats, quantum\u2011era uncertainty, and the deep convergence of OT, IT, cloud, and digital systems. Regulators across sectors are raising expectations, supply chains are more fragile than ever, and operational disruptions now carry consequences that extend far beyond financial loss.<\/p>\n

In this landscape, risk appetite cannot be static. It must evolve into a living governance instrument \u2014 one that continuously reflects the organization\u2019s strategy, technology footprint, and external environment.<\/p>\n

This blog explores what a modern risk appetite framework looks like, why traditional models are no longer sufficient, and how organizations across industries can build a system that is measurable, resilient, and Board\u2011ready.<\/p>\n

Why traditional risk appetite models are no longer enough<\/strong><\/h6>\n

Many organizations still rely on qualitative statements such as low tolerance for cyber risk.<\/em> These are well\u2011intentioned but ultimately unenforceable. Without quantified thresholds, they cannot guide decisions, justify investments, or withstand regulatory scrutiny.<\/p>\n

Five forces are driving the need for a more dynamic approach:<\/p>\n

1. Geopolitical Volatility<\/strong><\/p>\n

Sanctions, export controls, and supply chain weaponization now reshape risk exposure in real time. Appetite must explicitly address geopolitical scenarios.<\/p>\n

2. AI as Both Attacker and Asset<\/strong><\/p>\n

AI\u2011powered phishing, deepfake social engineering, autonomous scanning, and model\u2011drift risks demand a formal AI risk appetite \u2014 something most organizations still lack.<\/p>\n

3. Quantum Computing<\/strong><\/p>\n

With post\u2011quantum cryptography standards now published, harvest\u2011now, decrypt\u2011later<\/em>\u00a0risk is already live for organizations with long\u2011lived data or OT systems.<\/p>\n

4. OT \/ IT \/ Digital Convergence<\/strong><\/p>\n

Operational systems \u2014 clinical systems, trading platforms, grid SCADA, plant controls \u2014 are increasingly network\u2011connected. Excluding them from risk appetite is no longer defensible.<\/p>\n

5. Regulatory Acceleration<\/strong><\/p>\n

NIS2, DORA, the EU AI Act, HIPAA updates, SEC rules, and sector\u2011specific obligations now require demonstrable, quantified appetite.<\/p>\n

A Modern Risk Appetite Framework: A Continuous, Connected System<\/strong><\/h6>\n

A contemporary risk appetite model is not a document \u2014 it is an ecosystem. Seven components form the backbone:<\/p>\n

1. Crown Jewels<\/strong><\/p>\n

Tier assets by consequence of compromise \u2014 not by who owns them. Critical operational systems must be included.<\/p>\n

2. Business Impact Analysis (BIA)<\/strong><\/p>\n

Quantify disruption cost using RTO, RPO, MTPoD, and MBCO. These values directly set appetite thresholds.<\/p>\n

3. Loss Expectancy & Cyber Risk Quantification<\/strong><\/p>\n

Convert risk into financial terms (ALE) and probability ranges (VaR). This is the bridge between the Board, the CFO, and the risk function.<\/p>\n

4. CMDB<\/strong><\/p>\n

An authoritative inventory \u2014 including OT, medical devices, trading systems, and grid controls \u2014 is essential for meaningful quantification.<\/p>\n

5. Setting Appetite<\/strong><\/p>\n

Board\u2011approved thresholds and KRI bands per risk category. No more qualitative\u2011only statements.<\/p>\n

6. Controls & KRIs<\/strong><\/p>\n

ROSI\u2011based investment decisions and automated monitoring that signals when thresholds are approached.<\/p>\n

7. Monitor & Adapt<\/strong><\/p>\n

A continuous loop. AI deployments, cloud migrations, M&A, geopolitical shifts, regulatory changes, and incidents must trigger immediate review.<\/p>\n

What Good Governance Looks Like?<\/strong><\/h6>\n

Across industries, mature organizations share five traits:<\/p>\n

1. Board Ownership<\/strong><\/p>\n

The Board signs the appetite, reviews breaches, and understands the financial exposure.<\/p>\n

2. Critical Systems in Scope<\/strong><\/p>\n

Operational systems \u2014 trading cores, EMR systems, grid SCADA, plant controls \u2014 are included in Crown Jewels, CMDB, and BIA.<\/p>\n

3. Quantified Thresholds<\/strong><\/p>\n

ALE, VaR, and ROSI are standard inputs to decision\u2011making.<\/p>\n

4. Supply Chain Reality<\/strong><\/p>\n

Concentration limits are explicit. Third\u2011party dependencies are mapped. Exceeding thresholds triggers escalation.<\/p>\n

5. Living Governance<\/strong><\/p>\n

Appetite is refreshed every 6\u201312 months and whenever the environment changes.<\/p>\n

The opposite patterns \u2014 qualitative\u2011only statements, OT excluded as operations,<\/em> no quantification, no refresh triggers \u2014 are the root causes of major failures.<\/p>\n

Four principles every organization must adopt<\/strong><\/h6>\n

1. Critical operational systems must be in scope \u2014 no exceptions.<\/strong><\/p>\n

If a system can halt operations, harm patients, disrupt the grid, or stop trading, it belongs in the appetite framework.<\/p>\n

2. Appetite must be expressed in financial terms.<\/strong><\/p>\n

Low tolerance<\/em>\u00a0is not governance. Boards must know the ALE and VaR for their top scenarios.<\/p>\n

3. Refresh every 6\u201312 months.<\/strong><\/p>\n

The risk surface changes too quickly for multi\u2011year cycles.<\/p>\n

4. Test resilience \u2014 do not declare it.<\/strong><\/p>\n

Failover, recovery, and manual fallback must be validated through exercises, not assumed.<\/p>\n

When It Works \u2014 and When It Fails<\/strong><\/h6>\n

1. When It Works \u2014 Hypothetical Scenarios<\/strong><\/p>\n