A manufacturing company faced a risk of production delays due to potential supply chain disruptions.

Risk retention means accepting the risk, either knowingly or by default, often because it is deemed acceptable or cost-effective compared to the mitigation effort. In this scenario, the company assessed the risk and decided to accept it, which is classic risk retention.

“Risk retention involves knowingly accepting a risk. Risk retention can be a conscious decision based on risk assessment.”

— ISO/IEC 27001:2022, Clause 6.1.3, ISO/IEC 27005:2022, Section 8.3.2