Why should an organisation identify its risk appetite when writing a cyber strategy, and how can that decision be used later?

### What a good answer covers - Define risk appetite as the organisation’s willingness to accept risk in pursuit of its objectives. - Explain that the strategy must balance risk reduction with informed innovation. - Show how the stated appetite can guide later choices, including supplier reviews and new technology. - Note that senior leaders should understand and endorse the strategy’s direction. ### The concept Risk cannot always be removed without affecting how an organisation works. A stated appetite gives decision-makers a reference point for judging whether a proposed risk is acceptable, needs controls, or should be avoided. For example, a care provider may accept the operational risk of secure remote working because it supports frontline care, while requiring strict controls for access to sensitive records. The strategy gives this balancing decision a consistent organisational basis. ### Terms - **Risk appetite**: the amount and type of risk an organisation is willing to accept. - **Vendor**: an external supplier of a product or service. ### Remember Risk appetite turns broad values into a reference for later decisions.