Skip to main content
Regulatory Council
Commerce Security logo, "All 12 PCI DSS Requirements in Plain English," "Get it now for free," "Complete Survival Guide" and a button toclick to get it
Category: Business Continuity & Resilience

Impact Tolerance Threshold

Also known as: Impact Tolerance
Simply put

An impact tolerance threshold is the point at which a disruption to a critical or important business service becomes too damaging to accept. In simple terms, it marks the maximum amount of disruption an organization believes it can withstand before customers, markets, or the organization itself suffer unacceptable harm. Firms use it to decide how much disruption they must be able to absorb and where they must set limits.

Formal definition

In operational resilience practice, impact tolerance is typically defined as the maximum tolerable level of disruption to an important or critical business service before intolerable or unacceptable harm results, and it is often expressed in terms such as maximum tolerable duration of disruption. The impact tolerance threshold refers more specifically to the justification for, and the level at which, an impact tolerance is set, providing the basis on which firms determine the boundary between tolerable and intolerable disruption to a given service. As a resilience concept it is distinct from a risk appetite or a control: it defines an outcome-based limit on disruption to a service rather than the treatment applied to a risk. Specific quantitative thresholds, metrics, and any binding regulatory requirements vary by jurisdiction, sector, and the applicable supervisory framework, and should be verified against the relevant primary source.

Why it matters

Impact tolerance thresholds shift the focus of resilience planning away from whether a disruption might occur toward how severe a disruption an organization can absorb before customers, markets, or the organization itself suffer unacceptable harm. This outcome-based orientation is significant because it acknowledges that some level of disruption to critical or important business services is often unavoidable; the more actionable question becomes where the boundary between tolerable and intolerable harm lies. By setting a defined threshold, an organization creates a concrete target against which it can test its ability to prevent, adapt to, respond to, recover from, and learn from disruption.

The threshold matters because it provides a justification and a documented rationale for where each impact tolerance is set, rather than leaving that judgment implicit or inconsistent across services. This helps ensure that limits reflect the actual harm a disruption could cause to customers and markets, not merely internal operational preferences. It also gives boards, management, and supervisors a common reference point for evaluating whether investment in resilience is proportionate to the potential harm a given service failure could produce.

Because specific quantitative thresholds, metrics, and any binding requirements vary by jurisdiction, sector, and the applicable supervisory framework, the value of an impact tolerance threshold lies as much in the reasoning behind it as in the number itself. Firms should verify applicable expectations against the relevant primary source, since what constitutes an acceptable threshold and how it must be evidenced can differ substantially across regulatory environments.

Who it's relevant to

Operational Resilience and Business Continuity Teams
These teams use impact tolerance thresholds to define how much disruption each critical or important business service must be able to withstand, and to design testing and recovery arrangements against that boundary. The documented justification for each threshold guides where resilience investment and capability need to be concentrated.
Risk Managers
Risk managers benefit from understanding how an impact tolerance differs from a risk appetite. While both express limits, an impact tolerance sets an outcome-based boundary on disruption to a service rather than defining how a risk is treated. Recognizing this distinction helps ensure resilience limits and risk treatment decisions are aligned but not conflated.
Boards and Senior Management
Boards and executives rely on impact tolerance thresholds as a reference point for judging whether an organization's ability to absorb disruption to critical services is proportionate to the potential harm. The justification behind each threshold supports informed oversight and decisions about resilience investment.
Compliance Officers and Supervisory Liaisons
Because applicable expectations, metrics, and any binding requirements vary by jurisdiction, sector, and supervisory framework, compliance professionals are responsible for confirming what an organization must evidence when setting and justifying impact tolerances. They should verify specific obligations against the relevant primary source rather than assume uniform requirements.

Inside Impact Tolerance Threshold

Tolerable Level of Disruption
The maximum extent of disruption to a service or business function that an organization is prepared to accept before consequences become unacceptable. This is typically expressed in relation to a defined outcome rather than an abstract risk measure.
Metric or Measurement Basis
The quantifiable dimension against which tolerance is set, which may include time (duration of outage), volume (number of affected transactions or customers), or another measurable indicator. The chosen basis should be specific enough to support monitoring and testing.
Reference Point or Boundary
The threshold value that separates acceptable from unacceptable outcomes. Crossing this boundary is intended to trigger escalation, remediation, or predefined response actions. The boundary is often tied to a particular scenario or set of assumptions.
Linked Objective or Service
The specific business service, operational process, or objective to which the threshold applies. Impact tolerance is typically defined at the level of an important business service rather than the organization as a whole.
Scenario Context
The set of assumptions and conditions under which the threshold is assessed, since tolerance for disruption may differ depending on the nature, cause, and timing of an event.

Common questions

Answers to the questions practitioners most commonly ask about Impact Tolerance Threshold.

Is an impact tolerance threshold the same as risk appetite?
No. Risk appetite typically expresses the amount and type of risk an organization is willing to pursue or accept in pursuit of its objectives, stated before an event materializes. An impact tolerance threshold, by contrast, generally expresses the maximum level of disruption or harm an organization is prepared to withstand once an adverse event has occurred, often for a specific service or process. The two concepts are related but operate at different points: appetite frames forward-looking risk-taking, while impact tolerance frames the outer limit of tolerable consequences during and after disruption. Terminology and precise meaning vary by framework and jurisdiction, so the source definition should be confirmed against the applicable regime.
Does setting an impact tolerance threshold mean the organization is accepting that level of harm as a target?
Not in the sense of aiming for it. An impact tolerance threshold is commonly framed as an outer boundary that should not be breached, not a performance target to be reached. It describes the point beyond which disruption or harm would be considered unacceptable, which in turn informs how resilience, controls, and recovery capabilities are designed and tested. Operating well within the threshold is typically the intended state; the threshold itself marks a limit rather than a goal. How it is interpreted can depend on the specific framework or regulatory expectation in question.
How can an organization go about setting an impact tolerance threshold in practice?
Approaches vary, but organizations often begin by identifying the services, processes, or objectives to which the threshold will apply, then determining the relevant dimensions of impact, which may include financial loss, customer or market harm, operational disruption, or regulatory consequences. The threshold is frequently expressed in measurable terms such as time, volume, or magnitude where feasible. Setting a threshold typically involves input from business, risk, and governance stakeholders and, where applicable, alignment with regulatory expectations. Because appropriate levels are highly context-dependent, this description is general and specific values should be derived from the organization's own analysis and any binding requirements.
Who should own and approve impact tolerance thresholds within the governance structure?
Ownership arrangements differ by organization and framework, but responsibility for approving impact tolerance thresholds is often placed at a senior governance level, such as the board or a delegated committee, given that thresholds reflect the organization's willingness to withstand disruption to its objectives. Day-to-day identification, measurement, and monitoring may sit with management and relevant risk, resilience, or compliance functions. Clear allocation of decision rights is generally regarded as part of sound governance. The precise ownership model should be defined in the organization's own policies and any applicable regulatory guidance.
How should impact tolerance thresholds be tested and validated?
Thresholds are commonly assessed through scenario analysis, stress testing, or simulation exercises intended to explore whether the organization could remain within its defined limits under plausible disruptive conditions. Testing may examine severe but plausible scenarios rather than only expected ones. The results can highlight gaps between current capabilities and the stated threshold, informing remediation. Testing methods and frequency vary by framework, sector, and organization, and no exercise can fully predict actual outcomes, so testing is generally treated as an ongoing activity rather than a one-time validation.
How often should impact tolerance thresholds be reviewed?
Review frequency is context-dependent and often driven by both a periodic cycle and event-based triggers. Periodic review, such as on a regular governance schedule, helps ensure thresholds remain aligned with current objectives and conditions. Event-based triggers may include significant changes to services or processes, material incidents, shifts in the operating environment, or changes in applicable regulatory expectations. The appropriate cadence should be set out in the organization's own framework, and specific requirements, where they exist, should be confirmed against the primary source.

Common misconceptions

Impact tolerance and risk appetite are the same thing.
They are related but distinct. Risk appetite typically expresses the amount and type of risk an organization is willing to pursue or accept in pursuit of its objectives, whereas an impact tolerance threshold often expresses the maximum level of disruption to a specific service that can be tolerated before serious harm occurs. The two operate at different levels and serve different purposes, and their precise definitions can vary by framework and jurisdiction.
Setting an impact tolerance threshold reduces or eliminates the underlying risk.
A threshold is a defined boundary and measurement point, not a control. It does not by itself modify the likelihood or severity of disruption. Reducing residual risk still depends on the controls, resilience measures, and response arrangements the organization puts in place.
Impact tolerance thresholds are a fixed, one-time regulatory number that applies uniformly.
Thresholds are typically context-dependent and set per service, and their applicability, terminology, and any regulatory expectations vary by jurisdiction, sector, and organization. They are generally intended to be reviewed and revised as services, dependencies, and conditions change. Specific regulatory requirements should be verified against the applicable primary sources.

Best practices

Define each impact tolerance threshold in relation to a specific important business service or objective, rather than applying a single organization-wide figure.
Express the threshold using a clear and measurable basis, such as duration of disruption or volume affected, so that it can be monitored and tested consistently.
Document the scenario assumptions and conditions under which the threshold applies, recognizing that tolerable disruption may differ across event types and timing.
Distinguish the threshold from the controls and resilience measures intended to keep disruption within it, and assess residual exposure separately.
Establish escalation and response actions that are triggered when the threshold is approached or breached, and confirm these are understood by accountable owners.
Review and revise thresholds periodically and after material changes to services, dependencies, or the operating environment, and verify any regulatory expectations against the applicable primary sources for your jurisdiction and sector.
Application Security Isn’t Optional Anymore.