An organization's decision on acceptable degrees of residual risks should be based on; choose one. Response:

System-level risk appetite is too granular; organizational risk tolerance provides the enterprise-wide context for acceptable risk across all systems.

Organizational risk picture is a current assessment of risks, not the predefined benchmark for acceptable risk levels.

Organizational risk tolerance is the overarching level of risk an organization is willing to accept after security controls have been implemented. Decisions about whether the remaining (residual) risks are acceptable must align with this predefined tolerance to ensure consistency and adherence to the organization's risk management strategy.

Tier 3 risk tolerance refers to the enterprise-wide perspective within NIST's three-tiered risk management approach, which is a specific framework, but 'Organizational risk tolerance' is the more general and widely applicable term for setting acceptable residual risk.