Why do I need a risk Acceptance Criteria for ISO 27001?

Risk acceptance criteria give an organisation a consistent way to decide which information security risks it can tolerate and which risks need further action. Without clear criteria, different managers may reach different decisions about similar risks, leading to inconsistent protection, unclear accountability and avoidable exposure.

ISO 27001 requires organisations to define and apply information security risk criteria. These criteria support risk assessment, risk evaluation and risk acceptance. They help the organisation compare risks against an agreed threshold rather than relying on personal opinion or reacting to whichever issue appears most urgent.

A strong approach answers practical questions. What level of risk can the business accept? Who can approve that decision? Which risks always require treatment? How long can a temporary acceptance remain open? When must the organisation review the decision again?

UK Cyber Compliance supports organisations through this process using an automated and AI-driven platform. UK Cyber Compliance (a part of UK Cyber Security Group) provides these services and has a platform to make certification much easier and cheaper. The platform helps businesses connect risk scores, acceptance thresholds, treatment decisions, owners, controls, evidence and audit records in one place.

Turning risk scores into business decisions

A risk score has little value unless the organisation knows what to do with it. A register may show that one risk has a score of eight and another has a score of sixteen, but those numbers do not create action by themselves.

Risk acceptance criteria explain what each result means. The organisation may decide that lower scores sit within tolerance, moderate scores need monitoring and higher scores require formal treatment. Serious risks may need senior approval, immediate action or escalation to the board.

Clear thresholds make the process more predictable. Staff can assess risks using the same rules, managers can compare priorities and auditors can see how the organisation reaches its decisions.

ISO committee guidance explains that organisations should establish criteria for performing information security risk assessments and define risk acceptance criteria. The method should produce consistent, valid and comparable results.

Risk acceptance does not mean ignoring a problem

Some people hear the word acceptance and assume that the business has decided to do nothing. That interpretation misses the purpose of the process.

Risk acceptance means that an authorised person has reviewed the risk, considered its likelihood and impact, examined current controls and decided that the remaining exposure falls within approved limits.

The organisation should record that decision. The record should identify the risk owner, approver, reason, date and next review point.

An accepted risk may still need monitoring. A change in threat activity, customer requirements, legal duties, suppliers or systems could make the earlier decision unsuitable.

The organisation may also accept a risk temporarily while treatment takes place. In that situation, the record should explain the conditions, target date and escalation point.

What is ISO 27001 Certification?

ISO 27001 certification provides independent confirmation that an organisation operates an Information Security Management System that meets ISO/IEC 27001 requirements.

An Information Security Management System, often called an ISMS, gives the business a structured way to manage information security. It brings together scope, leadership, risk assessment, risk treatment, objectives, resources, controls, internal audit, management review and continual improvement.

ISO describes ISO/IEC 27001 as the best-known standard for information security management systems. It helps organisations become more risk-aware, identify weaknesses and address information security concerns through a joined approach across people, policies and technology.

Certification does not promise that the organisation will never suffer an incident. It demonstrates that the business has established a controlled process for identifying, evaluating, treating and reviewing risk.

Risk acceptance criteria support that process. They show that management decisions follow agreed rules rather than informal judgement.

what is iso 27001

ISO 27001 is the commonly used name for ISO/IEC 27001:2022, the international requirements standard for information security management systems.

The standard helps organisations protect confidentiality, integrity and availability.

Confidentiality means information only reaches authorised people and systems.

Integrity means information remains accurate, complete and trustworthy.

Availability means authorised users can access information and services when they need them.

ISO 27001 applies risk management across the ISMS. The organisation identifies information security risks, analyses their likelihood and consequences, evaluates the resulting exposure and chooses treatment.

ISO/IEC 27005 supports this work by providing guidance across the information security risk management cycle, including assessment, treatment, communication, acceptance, monitoring and review.

The difference between risk appetite and acceptance criteria

Risk appetite and risk acceptance criteria relate closely, but they do not mean exactly the same thing.

Risk appetite describes the general amount of exposure that an organisation is willing to pursue or retain while working towards its objectives. It often appears as a management statement.

For example, a business may state that it has very little appetite for risks that could expose customer information, interrupt critical services or breach legal duties.

Risk acceptance criteria turn that broad position into practical decision rules. They define the thresholds, conditions and approval levels that staff apply to individual risks.

A risk appetite statement may say that the organisation has low tolerance for unauthorised access.

The acceptance criteria may state that any residual access risk rated high requires executive approval and further treatment, while a low residual risk may receive approval from the system owner.

The appetite sets direction. The criteria make that direction usable.

What your acceptance criteria should cover

A useful set of criteria should explain more than the highest acceptable score.

It should define:

How the organisation measures likelihood

How it measures impact

How it calculates the risk level

Which scores fall within tolerance

Which scores need treatment

Who can approve acceptance

Which risks require senior escalation

How temporary acceptance works

How long an approval remains valid

When the organisation must reassess the risk

Which legal, contractual or customer concerns override the normal score

These rules create consistency across the business. They also help new risk owners understand what management expects.

Keep the criteria proportionate. A small organisation may use a straightforward matrix and short approval table. A complex provider may need different thresholds for critical services, regulated information and major suppliers.

Define likelihood in a consistent way

Likelihood describes how realistically a risk event may occur.

The organisation should define each rating so that staff apply it consistently. A label such as possible or likely needs a shared meaning.

The assessment may consider:

Previous incidents

Current threat activity

Known weaknesses

Exposure to external networks

Frequency of the relevant process

Supplier dependency

Staff access

Control reliability

Changes in systems or services

A low likelihood should not mean that the event cannot happen. It means that the available evidence suggests a lower chance when compared with other scenarios.

Documented examples can help staff choose the right rating. They also make internal audit easier because the auditor can compare the score with the approved method.

Define impact using real business consequences

Impact describes the harm that the organisation could suffer if the event occurred.

A useful impact scale should consider more than direct financial loss. It may cover:

Loss of customer trust

Service interruption

Legal exposure

Contractual failure

Personal data harm

Damage to sensitive information

Loss of system availability

Unauthorised information changes

Staff disruption

Supplier failure

Reputational damage

Senior managers and process owners should help define impact. They often understand customer expectations and operational consequences better than a technical team working alone.

For example, an hour without an internal reporting tool may cause limited inconvenience. An hour without a critical customer service may create contractual and reputational harm.

The criteria should make that difference clear.

Set clear thresholds

Once the organisation defines likelihood and impact, it can create thresholds for acceptance and treatment.

A simple approach may place results into four bands.

Low risks may sit within tolerance and receive approval from the risk owner.

Moderate risks may need monitoring, additional review or proportionate treatment.

High risks may require formal treatment and approval from senior management.

Critical risks may require immediate escalation and may remain unacceptable until the organisation reduces them.

The exact thresholds should reflect the organisation’s services, legal duties, customer commitments and business objectives.

Do not copy another company’s threshold without considering your own context. A service provider handling sensitive customer information may need stricter criteria than a business that holds little confidential data.

Identify risks that the organisation cannot accept

Some risks should require treatment regardless of their numerical score.

Examples may include exposure that would breach a law, violate a customer contract, put people at risk or undermine a critical service commitment.

A low likelihood does not always make a severe legal or contractual consequence acceptable.

The acceptance criteria should therefore include overriding conditions. These conditions tell staff when a score alone cannot support the decision.

For example, the business may state that it will not accept a known breach of a legal duty. It may also reject any risk that could expose administrator credentials without effective protection.

This prevents a scoring model from overriding basic governance responsibilities.

Give approval authority to the right people

Not every manager should have authority to accept every risk.

The approval level should reflect the seriousness of the exposure and the manager’s responsibility.

A system owner may approve a low risk within an established process.

A department head may approve a moderate operational risk.

A director or formal risk committee may need to approve a high residual risk.

The board may need to review risks that could threaten strategic objectives, major customer commitments or the survival of the organisation.

The criteria should name roles rather than individual people where practical. This keeps the process stable when staff change.

Approval authority should also match budget responsibility. A person cannot meaningfully accept a serious risk when they lack the authority to approve treatment or allocate resources.

The role of the risk owner

The risk owner remains accountable for understanding and managing the risk.

This person should:

Confirm the risk scenario

Review likelihood and impact

Check existing controls

Approve treatment proposals

Monitor action progress

Review residual exposure

Request acceptance where appropriate

Reassess the risk after change

Escalate issues that exceed their authority

The risk owner may not perform every security task. A technical team might configure a control, while the risk owner remains responsible for the wider business exposure.

ISO guidance for auditors highlights the need for clear ownership and suitable authority within the risk process.

Current risk and residual risk

The organisation should distinguish between current exposure and the risk expected after treatment.

Current risk reflects the position after considering controls that already operate.

Residual risk reflects what remains after the organisation completes planned treatment.

Acceptance should normally focus on the residual risk because that represents the position the organisation expects to retain.

Do not reduce a residual rating simply because the business has written an action plan. The organisation should complete the action, confirm that the control works and then reassess the risk.

For example, a planned multi-factor authentication rollout does not reduce the risk until users receive the protection and the organisation verifies its operation.

Honest scoring supports better decisions and reduces audit surprises.

When temporary acceptance makes sense

Businesses cannot always complete treatment immediately. A supplier may need time to deliver a feature, a project may require scheduled change or the organisation may need to replace a system.

Temporary acceptance can support a controlled response when the business cannot remove the exposure straight away.

The approval should record:

Why immediate treatment cannot occur

Which interim controls operate

Who approved the temporary position

The final treatment action

The responsible owner

The target date

The review frequency

The escalation point

Temporary acceptance should not become a way to leave overdue actions open indefinitely.

When the target date passes, management should review the decision, complete treatment or approve a documented extension with a clear reason.

Acceptance and the risk treatment process

ISO 27001 requires the organisation to determine appropriate risk treatment options.

The business may reduce, avoid, share or retain the risk.

Reduction involves applying controls that lower likelihood or impact.

Avoidance involves stopping the activity that creates the exposure.

Sharing may involve contracts, external services or insurance arrangements, although responsibility may still remain with the organisation.

Retention means accepting the remaining risk under the approved criteria.

ISO/IEC 27005 describes risk acceptance as part of the wider information security risk management process.

The treatment decision should appear in the risk register or connected record. It should not sit only in informal emails or meeting discussions.

The link with Annex A controls

When an organisation chooses to reduce risk, it determines the controls needed to support that decision.

The business then compares its selected controls with ISO 27001 Annex A to check that it has not missed a relevant measure.

A risk involving unauthorised cloud access may need controls for identity management, authentication, privileged access, logging, monitoring and supplier relationships.

A risk involving service interruption may need backup, redundancy, supplier assurance, continuity and incident response controls.

The Statement of Applicability records the controls the organisation has determined are necessary, their implementation status and reasons for excluding Annex A controls.

Acceptance criteria help explain why a residual risk remains after those controls operate.

The link with the risk register

The risk register should show how the organisation applied its acceptance criteria to each risk.

Useful fields include:

Risk reference

Risk description

Affected asset or process

Likelihood

Impact

Current level

Existing controls

Treatment decision

Planned actions

Residual level

Risk owner

Acceptance decision

Approver

Approval date

Review date

Conditions

This information creates traceability. An auditor can see the risk, review the score, check the threshold, inspect the treatment and confirm who accepted the remaining exposure.

A central platform can make this easier by connecting each record with controls, evidence and owners.

Evidence that supports acceptance

Risk acceptance should rest on evidence, not optimism.

Relevant evidence may include:

Control test results

Access reviews

Vulnerability reports

Supplier assessments

Backup tests

Incident records

Monitoring reports

Internal audit findings

Customer requirements

Legal reviews

Management decisions

Completed treatment actions

The risk owner should use this evidence when reviewing likelihood, impact and residual exposure.

An old report may not support a current decision. The organisation should confirm that the evidence still reflects the present environment.

Why informal decisions create problems

Without defined criteria, managers may accept risk through silence. Treatment actions remain overdue, known weaknesses continue and nobody records the decision.

This creates several problems.

The business cannot show who approved the exposure.

Different teams may make conflicting decisions.

Leaders may not know that a serious risk remains open.

Auditors may find no consistent method.

Customers may receive inaccurate assurance.

Resources may go towards less important concerns.

Clear criteria prevent risk acceptance from becoming accidental.

Making the criteria proportionate for a small business

A small organisation does not need an overly complicated scoring model.

A practical method may use a five-point likelihood scale, a five-point impact scale and a clear matrix. The business can then define approval rules for low, moderate, high and critical results.

The written criteria may fit within a short risk methodology document.

What matters is consistency. Staff should understand the ratings, risk owners should know their authority and management should review serious exposure.

A simple method that the organisation follows provides more value than a complicated method that nobody maintains.

UK Cyber Compliance can help smaller businesses organise this process through guided workflows and centralised records.

Who needs iso 27001 certification

ISO 27001 certification can benefit organisations that handle valuable information or need to demonstrate structured security management.

Technology providers, managed service providers, consultancies, healthcare suppliers, financial organisations, manufacturers, charities and public sector suppliers may all find it useful.

Customer assurance often drives certification. Clients want evidence that suppliers understand information security risk, assign responsibility and operate effective controls.

Contracts, tender requirements, board governance, investor expectations and international business may also create a need.

ISO states that organisations across different sectors can use the standard to manage information entrusted by customers and other interested parties.

Risk acceptance criteria matter for each of these organisations because they show how leaders decide whether exposure remains tolerable.

ISO 27001 Certification Levels

ISO 27001 does not use formal achievement bands such as bronze, silver or gold.

An organisation either holds certification for its stated ISMS scope or it does not.

Businesses do move through practical stages. These may include defining scope, assessing risk, setting acceptance criteria, selecting controls, gathering evidence, completing internal audit, holding management review and undergoing external assessment.

Security maturity can improve after certification. The organisation may strengthen controls, automate evidence collection, refine its criteria or improve management reporting.

That progress reflects continual improvement rather than an official certification band.

How the Certification Works

The organisation starts by understanding its context, interested parties and ISMS scope.

It then defines a risk assessment method. This method includes criteria for assessing likelihood, impact and risk acceptance.

The organisation identifies and evaluates information security risks, assigns owners and determines treatment.

It selects necessary controls, compares them with Annex A and prepares the Statement of Applicability.

The business puts the controls into operation and gathers evidence. It completes internal audit and management review before the external certification assessment.

A certification body normally completes an initial readiness assessment followed by a deeper review of implementation and effectiveness.

After successful certification, continuing assessment checks whether the organisation maintains and improves the ISMS.

Risk acceptance decisions must remain current throughout this process. An approval made during the initial project may need reassessment after incidents, major changes or new customer obligations.

Review criteria when the organisation changes

Acceptance criteria should not remain unchanged forever.

Review them when:

The organisation launches a critical service

Customer expectations increase

A law or regulatory duty changes

The business enters a new sector

A serious incident occurs

Threat activity changes significantly

The company adopts major technology

A supplier becomes critical

Internal audit identifies inconsistency

Management changes its risk appetite

The criteria should continue to reflect business reality.

The risk register also needs regular review. Each accepted risk should have a date or trigger that prompts reassessment.

Current UK cyber risk supports a disciplined approach

The UK Government’s Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of businesses identified a cyber breach or attack during the previous 12 months. Only 25 per cent had a formal incident response plan.

Government analysis also described the 43 per cent finding as more than 600,000 organisations.

These findings show why businesses need clear risk decisions. Threats remain common, while many organisations lack formal preparation.

Acceptance criteria help leaders identify which exposure demands treatment, where resources should go and which remaining risks need formal approval.

Common mistakes with risk acceptance criteria

One common mistake involves defining a score without defining approval authority.

Another involves accepting every low-scoring risk automatically, even when it could breach a legal or contractual requirement.

Some organisations confuse current risk with residual risk. They approve the present exposure while treatment remains incomplete.

Others use vague language such as “management will decide” without naming the responsible role or process.

Further weaknesses include:

No review date

No conditions for temporary acceptance

No evidence behind the rating

No connection with the risk appetite

No escalation process

Inconsistent decisions between departments

Old thresholds that no longer reflect the business

Acceptance recorded before controls operate

A clear methodology helps prevent these issues.

Which UK-based firms offer ISO 27001 consultancy services?

UK organisations can seek ISO 27001 support from information security consultancies, compliance advisers, managed service providers, internal audit specialists and platform-led providers.

UK Cyber Compliance supports ISO 27001 through an automated and AI-driven platform. Its service includes structured workflows, risk management support, document organisation and audit-readiness tools.

A capable provider should help the organisation define a proportionate method, create meaningful acceptance thresholds, assign approval authority and connect decisions with treatment and Annex A controls.

Good support should leave the organisation able to manage its own ISMS. Leaders and risk owners must understand and approve the criteria rather than relying entirely on an external adviser.

How UK Cyber Compliance supports acceptance decisions

Managing risk criteria through disconnected spreadsheets can create confusion. One file may contain scores, another may contain actions and a third may contain approval notes.

UK Cyber Compliance brings this information into one platform. Teams can record likelihood, impact, treatment, owners, actions, evidence and acceptance status in a connected process.

Automated workflows can highlight missing approvals, overdue actions and risks that exceed the agreed threshold.

AI-driven support can guide users through the certification journey, while dashboards give management greater visibility of open and accepted exposure.

The platform supports decisions but does not replace human accountability. Senior leaders still set appetite, owners still assess risk and authorised managers still approve acceptance.

A practical acceptance criteria template

A useful methodology can include the following rules:

Low risk: The risk owner may accept the exposure when controls operate effectively and no overriding legal, contractual or customer requirement applies.

Moderate risk: The risk owner must consider proportionate treatment. A department head approves any decision to retain the exposure.

High risk: The organisation must create a treatment plan. A director approves any temporary retention and reviews progress regularly.

Critical risk: The organisation treats the risk as unacceptable unless the board or equivalent authority records an exceptional decision with immediate safeguards and a fixed action date.

The methodology should also define:

How long approval remains valid

Which evidence supports the decision

What triggers reassessment

How the organisation records temporary exceptions

Who reports accepted high risks to management

How internal audit checks consistency

Adapt the wording to the organisation’s own context and responsibilities.

Questions an auditor may ask

An auditor may review an accepted risk and ask:

How did you calculate the rating?

Which criteria did you use?

Why does the residual exposure remain tolerable?

Who approved the decision?

Did that person have suitable authority?

What controls operate?

What evidence shows that they work?

When will you review the decision?

What would trigger earlier reassessment?

How does the acceptance align with your risk appetite?

Does the Statement of Applicability reflect the selected controls?

Clear records help the organisation answer these questions with confidence.

Create criteria that support real management

You need risk acceptance criteria because ISO 27001 depends on consistent and informed risk decisions.

The criteria turn broad statements about risk appetite into clear thresholds, approval rules and review requirements. They help staff understand which exposure they can manage, which risks require treatment and which decisions need senior authority.

A strong method considers likelihood, impact, legal duties, contracts, customer requirements, current controls and residual exposure. It also records who approved the decision and when the organisation must review it.

UK Cyber Compliance provides an automated and AI-driven platform that helps businesses connect criteria, risk registers, controls, actions, evidence and approvals.

When the organisation applies clear criteria consistently, risk acceptance becomes a controlled management decision rather than an informal choice. That strengthens the ISMS, improves audit readiness and gives leaders a more accurate view of the risks the business has chosen to retain.

UK Cyber Compliance is here to help

For more information, please do get in touch.

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks.