An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. This is an example of:

Risk mitigation involves actions taken to reduce the likelihood or impact of a risk, not the definition of acceptable deviation from a target.

Risk evaluation is the process of comparing estimated risk levels against risk criteria to determine significance, not the definition of acceptable deviation itself.

Risk appetite is the total amount and type of risk an organization is willing to pursue or retain to meet its strategic objectives; 99% availability might reflect the appetite, but 98.5% is the specific tolerance *level*.

Risk tolerance is the acceptable deviation from an organization's risk appetite or a specific risk target, defining the boundaries within which the organization is willing to operate when facing a particular risk, such as service availability.