The level of risk an organisation or individual is willing to accept before determining it is necessary to reduce that risk.