Acceptable level of risk

Definitions

General

An acceptable level of risk is

“

the level of risk that is tolerable in a given situation. It is determined from: an analysis of threats and vulnerabilities, the sensitivity of data and applications, a cost/benefit analysis, and a study of the technical and operational feasibility of available controls.

”

Military

An acceptable level of risk is

“

[a]n authority's determination of the level of potential harm to an operation, program, or activity due to the loss of information that the authority is willing to accept.

”

“

a judicious and carefully considered assessment by the appropriate Designated Approving Authority (DAA) that an automatic data processing (ADP) activity or network meets the minimum requirements of applicable security directives. The assessment should take into account the value of ADP assets, threats and vulnerabilities, countermeasures and their efficiency in compensating for vulnerabilities, and operational requirements.

”

See also

• Acceptable risk
• Risk