Who determines the acceptable level of risk for an organization's assets?

The determination of the acceptable level of risk for an organization's assets primarily falls to the asset owners. They are responsible for understanding the value of the assets and the potential impacts associated with risks. As individuals or entities that possess a vested interest in the assets, asset owners are in the best position to assess not only the importance of these assets to the organization but also the potential consequences of a loss or threat.

The asset owners evaluate their own risk tolerance, which is influenced by various factors, including organizational goals, business continuity requirements, and compliance with regulations. They must balance the benefits of risk mitigation strategies against the costs associated with implementing those measures.

Involving the security team and external auditors can provide valuable insights and perspectives on risks and mitigation strategies, but it is ultimately the asset owners who must make the final determination on what levels of risk they are willing to accept based on their understanding of the organization's objectives and risk appetite.