1 templates mapped to SOC 2 (CC3.2).
Board-level policy establishing organizational risk appetite and tolerance thresholds for technology and cybersecurity risks. Defines quantitative and qualitative risk metrics, risk categories, acceptable tolerance ranges, risk acceptance criteria, escalation triggers, and governance framework for risk-based decision making aligned with business objectives.