Scenario:A manufacturing company faced a risk of production delays due to potential supply chain disruptions.

According to ISO/IEC 27001:2022 Clause 6.1.3 (a), an organization must determine appropriate risk treatment options. ISO 27005:2022 (Clause 8.2.2) defines risk retention as:

“The decision to accept the risk without taking any action to reduce it, often because the cost of mitigation is greater than the benefit.”

The company assessed the likelihood and impact of the risk and decided not to mitigate, which qualifies as risk retention (also known as risk acceptance in ISO 27001 Clause 6.1.3(f)).