The FFIEC Cybersecurity Assessment Tool put a term in front of community bankers that most hadn’t seen much outside lending and credit: risk appetite. The FFIEC IT Examination Handbook’s Management booklet now references it ten times, including a requirement that the board define both the institution’s risk appetite and its risk tolerance levels. The Cybersecurity Assessment Tool itself brings it up six times, always in context:

• The institution has a cyber risk appetite statement approved by the board or an appropriate board committee.
• The board or board committee approved cyber risk appetite statement is part of the enterprise-wide risk appetite statement.
• The risk appetite is informed by the institution’s role in critical infrastructure.
• The independent audit function regularly reviews management’s cyber risk appetite statement.
• The independent audit function regularly reviews the institution’s cyber risk appetite statement in comparison to assessment results and incorporates gaps into the audit strategy.
• Threat intelligence is viewed within the context of the institution’s risk profile and risk appetite to prioritize mitigating actions in anticipation of threats.

Risk tolerance already has a home in banking guidance, and the two terms overlap enough that most institutions can treat them as synonyms. A working definition for risk appetite: the amount of risk your institution is willing to pursue and accept in order to reach the goals in its strategic plan.

Putting Risk Appetite to Work

You’ve likely already rated inherent and residual risk in your cybersecurity risk assessment as High, Medium, or Low. Risk appetite is management deciding that the residual number is one you can live with. You’re accepting what’s left as the cost of getting where the strategic plan says you’re going.

Take a vendor that comes back with high inherent risk. You apply controls, bring the risk down as far as it will go, and what’s left is the residual risk. Management weighs that residual number against the institution’s tolerance. A Low residual rating clears the bar easily. Even a Medium can clear it, as long as it sits inside the appetite the institution has set.

Qualitative or Quantitative

Setting cyber risk appetite works either qualitatively or quantitatively. A quantitative approach ties a specific dollar figure to a cybersecurity event. That’s a defensible way to document risk, but building it takes real financial modeling, and outside the largest institutions, that’s a hard bar to clear.

Most institutions land on a qualitative scale instead, something like 1 to 10 or High, Medium, Low. Management ranks how a cyber event would hit reputation, strategy, regulatory and legal standing, and operations, then sets the acceptable level for each category on its own terms. Your institution might hold a tight 1 to 3 tolerance on reputation risk and accept a looser 3 to 5 on the operational side. Both numbers can be right, for the same institution, at the same time.