Summary
At the beginning of this chapter, we learned about the 3LoD model and the responsibilities of each LoD. Then, we reviewed how we can translate the 3LoD model for IT risk management and cybersecurity. In the next section, we switched gears to learn about the importance of the risk profile, appetite, tolerance, capacity, the relationship between all of them, and how to distinguish between risk tolerance and risk capacity. Another major area covered in this chapter was how to determine the risk appetite for a business and the process for formal risk acceptance.
In the next chapter, we will learn about the legal, regulatory, and contractual requirements, along with ethical risk management.
