C1.5 Appetite versus tolerance

NIST IR 8286 Rev. 1 [9]

The component requires that appetite be a broad, qualitative statement set by the governing body, and that tolerance be a measurable range tied to at least one leading indicator and one lagging indicator; that neither substitute for the other; and that an appetite statement with no linked tolerance be recorded as incomplete (C1.5) [9]. The link to indicators is the test. A tolerance that cannot be observed in a number someone collects is an appetite statement wearing a different word, and the component refuses it.

It comes from the register series, renewed in December 2025, which Part II found to be the clearest source in the set on the first cluster: appetite as a broad statement set at the top, tolerance as a measurable range set lower down and tied to leading and lagging indicators, and the two not interchangeable. The cybersecurity framework's governance function asks for both statements in the same sense [23]. What the component reconciles is the enterprise framework's definition of tolerance as acceptable variation in performance [2] with the register series' requirement that the variation be measured by indicators: the first says what tolerance is, the second how one knows where one stands against it. An appetite of “cautious” for a category is a statement; the tolerance beneath it is a range on a named measure, with an indicator that anticipates a breach and one that records it.