Objective 2: Make decisions using a risk-based approach
Security decisions should rest on compliance duties and on the risk appetite of the entity itself, with security risk managed inside the entity risk framework rather than beside it.
What clause 7.2.2 asks
Two inputs set the scale for security decisions: what the law and contracts require, and what this particular entity is willing to risk. The appetite should cover lost competitive edge, compliance and liability exposure, disruption, reputational damage and money. Risk work should be consistent across the entity, should count financial, operational and reputational consequences, and should sit inside the entity's wider risk framework rather than beside it. Joining the two can mean adopting the entity method or placing strategic information risks in the entity register. Resources for the work should be allocated as part of governance, not left to whatever remains after other claims.
Why it matters
A risk appetite is the sentence that makes the rest of the governance testable. Without it, every security decision becomes an argument between the security team and the budget holder, and the winner is whoever has the louder meeting. The clause lists the consequences the appetite has to cover, including competitive advantage, which is easy to forget when the conversation is about controls. It also insists that security risk lives in the same framework as the other risks. A security risk register that the entity risk function has never seen is a parallel universe. It will not shape an investment decision, and it will not be believed when an incident happens.
What good looks like
Write the appetite as a small set of statements with thresholds the board can recognise, covering financial loss, operational disruption, compliance and liability, reputation and competitive position. Record who approved it and when. Then take five risks from the security register and show where each one sits in the entity register, or map the two methodologies and explain the translation. Resource the treatment decisions in the same budget cycle as the other entity risks, so security is not funded from what is left over.
Evidence a board or an auditor asks for
The approved risk appetite with thresholds and an approval date; the five mapped risks showing the translation between the security and entity registers; the resource decisions with the risk they address; the board paper that uses the appetite to justify a choice.
- Record The approved risk appetite with thresholds and an approval date
- Record the five mapped risks showing the translation between the security and entity registers
- Record the resource decisions with the risk they address
- Record the board paper that uses the appetite to justify a choice
Where it commonly fails
- Security decisions driven by compliance alone with no appetite stated
- A security risk register the entity risk function has never seen
- An appetite statement with no thresholds and no approver
What to do before publication
Before the edition 3 text is published, put clause 7.2.2 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 6.4 Thread of governance within the organization
- 7.2.3 Objective 3: Set the direction of acquisition
- 7.3.3 Direct
- 8.1 Organization and ISMS
← 7.2.1 Objective 1: Establish integrated, comprehensive, entity-wide information security7.2.3 Objective 3: Set the direction of acquisition →