How should CISOs work with business leaders to set acceptable risk before choosing controls?

Setting Risk in Business Terms Before You Pick Controls

Security controls are only defensible when they are tied to business-tolerated outcomes, not abstract best practice. The first job is to translate technical risk into operational language that non-security leaders can use to decide what is acceptable, what is not, and where the organisation is willing to trade convenience, cost, speed, or resilience for lower exposure.

That conversation should happen before control selection, because the same technical weakness can justify very different responses depending on business context. A control that is essential for one process may be disproportionate for another, and the right answer often depends on whether the business values uptime, customer trust, regulatory assurance, or speed to market more highly in that area.

In practice, CISOs are not asking leaders to approve every technical decision. They are asking leaders to define the decision boundary: what level of risk is tolerable, what failure would be unacceptable, and which assets or processes deserve stronger protection because their business impact is higher.

How Shared Risk Appetite Shapes Control Choice

Once leaders and security share a clear view of acceptable risk, control selection becomes a prioritisation exercise instead of a debate about opinion. That shared baseline helps security teams choose whether to harden, monitor, segment, restrict, automate, or accept a risk with compensating oversight.

This is especially important when controls create friction. Stronger controls often slow users, add operational overhead, or increase implementation cost, so the business needs to understand the trade-off being made. If that trade-off is not explicit, teams tend to select controls that are either too weak to matter or so heavy that they are bypassed in practice.

Shared risk appetite also improves consistency. It gives security a stable reference point for decisions across product teams, business units, and delivery cycles, which reduces the chance that similar risks are handled differently just because different managers are involved.

Turning Leadership Input Into Actionable Security Priorities

The most useful outcome of leadership engagement is a set of priorities that security can operationalise. Those priorities should identify which risks must be reduced, which can be tolerated with monitoring, and which need formal exception handling because the business has accepted them knowingly.

That clarity helps security teams choose the right kind of control. For example, a high-value business process may justify preventive controls and tighter access, while a lower-value process may be better served by detection, alerting, and recovery planning. The point is not to maximise control strength everywhere, but to align protection level with business impact.

It also creates a better basis for governance. When executives have stated what matters most, CISOs can explain why certain risks receive priority funding, why some initiatives are delayed, and why some requests require exceptions or additional review. That makes the security programme easier to sustain over time. For control frameworks that support this kind of governance and selection discipline, see NIST Cybersecurity Framework 2.0 and CIS Controls v8.

Practitioner Guidance

What to prioritise: Start with the business processes where failure would have the highest operational, financial, legal, or trust impact. Those are the areas where “acceptable risk” needs to be defined most clearly before any control discussion becomes meaningful.

What to verify: Make sure leaders can describe risk in terms of business consequence, not just vague comfort levels. If they cannot explain what loss, outage, or exposure would be tolerable, the control decision will usually drift toward whatever is easiest to buy or deploy.

Decision rule: If a risk is business-critical, choose controls that reduce both likelihood and blast radius; if a risk is tolerable but observable, choose detection and response controls that preserve decision-making speed.

Practitioner takeaway: The best control strategy starts with explicit business tolerance, because controls are only effective when they match the level of disruption, loss, or exposure the organisation has already agreed it can live with.

Related resources from NHI Mgmt Group

• Why do CISOs need risk data that business leaders can actually understand?
• How should security leaders get business stakeholders to take cybersecurity risk seriously before an incident happens?
• Why do CISOs need to translate security risk into business impact when prioritising controls?
• Why do non-human identities create more audit risk than human accounts?