Who can accept a cyber risk on behalf of the company?

The executive who owns the business outcome the risk threatens, acting within limits the board has set, in writing, with a date on which the acceptance expires. Not the security team: they identify and estimate risk, they don't own the consequences. Not the project sponsor who wants to ship: they have an interest in the answer. And not "the business" in the abstract. A named person, at a level that matches the size of the risk, who would be the one explaining it afterwards. If your organisation can't say who that person is for a given risk, nobody has accepted it. It's just been ignored with paperwork.

Why this question matters more than it looks

Every organisation runs with known gaps. The legacy system that can't be patched, the vendor with weak controls that the business can't replace, the deadline that pushed the fix to next quarter. Accepting those is legitimate; pretending they're closed is not. The difference is whether a person with authority has looked at the exposure and said "yes, we'll carry that," and whether it's written down. NIST's guidance on managing security risk describes a "risk executive" function for exactly this: a role or group at the organisation level that sets how risk decisions are made and makes sure they're consistent, rather than leaving each team to accept whatever's convenient (Joint Task Force Transformation Initiative, 2011).

The structure that works

The board sets the appetite. How much risk, of what kind, the organisation is willing to carry. In the current NIST framework this sits under the Govern function: risk appetite and tolerance are leadership decisions that the rest of the programme is built around (Pascoe et al., 2024). The board's guidance for directors says the same from the oversight side: directors should understand the organisation's risk appetite and whether management is working within it (National Association of Corporate Directors & Internet Security Alliance, 2026).

Executives accept within tiers. A risk that could cost a few thousand dollars or a day's disruption in one department can be accepted by that department's head. One that could trigger regulatory notification, material loss, or a safety consequence goes to the C-suite, and above a defined threshold to the board. Write the tiers down with numbers. Without them, every acceptance drifts to the lowest level that will sign.

Security advises and records. The security function estimates the risk honestly, using a consistent method (NIST's risk assessment guide is the standard reference), recommends, and keeps the register (Joint Task Force Transformation Initiative, 2012). It doesn't sign. A CISO who accepts risks on behalf of the business has quietly become the business's insurance policy, and will be the one blamed when the risk lands.

What a valid acceptance contains

The risk, in business terms. The estimate: how likely, how bad, and the basis for both. What was considered and rejected, and why. Any compensating measures. The name and role of the person accepting. The date it expires, after which it must be re-accepted or fixed. And the names of who was informed, including, above the threshold, the board. An acceptance without an expiry is a permanent exception, and permanent exceptions are how breaches happen (see A Security Exception Needs an Expiry Test).

The two failure patterns

Acceptance by the wrong person. The project manager signs because the form had a signature line. The IT director signs for a risk to customer data he doesn't own. The CISO signs because nobody else would. Each of these is a decision made by someone who won't bear the consequence, which is the definition of a decision that shouldn't count.

Acceptance by silence. The finding is raised, nobody responds, the project ships, and six months later the "accepted" risk has no owner, no record, and no expiry. This is the commoner pattern and the harder one to see, because it leaves no document. The fix is a rule that unaccepted findings above a threshold block go-live until someone signs, which is unpopular for a quarter and then becomes normal.

What I'd do next

Pull your current risk register, or the exceptions list if that's what you have, and check three things for every item above a modest threshold: a named accepting executive at the right tier, a basis for the estimate, and an expiry date. Most organisations fail on at least two. If you want help setting the tiers and the process so acceptances mean something, request a briefing. More on this cluster is in Executive leadership.