The security posture of an organization is usually expressed in terms of ___________________, which generally refers to how much
risk an organization is willing to accept to achieve its goal, and ____________________, which relates how much variance in the process an organization will accept.
An organisation's security strategy is normally defined in terms of risk appetite, which usually refers to how much risk an organization is ready to accept in order to achieve its target as well as how much risk tolerance an organisation can accept in the process.
Risk tolerance is the amount of risk which a company can tolerate on its risk, while risk appetite is the overall risk that a company can bear on a specified risk profile, generally expressed as a whole.
