Who is responsible for defining the tolerable residual cybersecurity risk as an input requirement for...

According to the ISA/IEC 62443 series, it is the asset owner's responsibility to determine what level of residual cybersecurity risk is acceptable after mitigation strategies are applied. This value becomes a key input in defining security levels and selecting controls.

“The asset owner is responsible for defining the tolerable residual risk and establishing acceptable security levels based on business impact and risk tolerance.”

— ISA/IEC 62443-3-2:2020, Clause 6.4.2 – Risk Evaluation Inputs

This forms the foundation for SL-T (Target Security Level) determination.