The organization’s role in critical infrastructure and its sector shall determine the organization’s risk appetite.