Risk acceptance is the decision to knowingly tolerate a specific risk when mitigation is impractical or cost-prohibitive.
Why it matters:
- Not every risk can or should be eliminated.
- Mature security programs document and monitor accepted risks.
Pro tip: Accepted risk should be explicit, approved, and revisited regularly — never accidental.
« Back to Glossary Index