Risk disposition is a Decision, not a footnote.

Accept residual operational risk until a named date, fund a mitigation, transfer through contract or insurance review, avoid the activity, or defer until a fact arrives.

The Decision Owner is often a risk lead, COO, or executive sponsor. Legal, finance, and the operator who lives with the exposure review the disposition. This is not the same page as a security-control comparison.

The residual exposure in plain language, the chosen disposition, who accepted it, against which Verdict version, and the review date.

Champion can defend mitigate. Challenger attacks an accept that has no expiry. Wolf hunts concentration and lock-in. Inspector will not treat a register row as a measured exposure. Judge can leave defer on the table.

Security Risk Acceptance is a residual security exposure and a compensating control. This page is broader enterprise risk: operational, commercial, and strategic dispositions. Cybersecurity remains the control-comparison page.

Adopting a Verdict does not automatically accept leftover exposure. The Human Decision has to record the disposition.

Champion and Challenger test the case, Inspector checks the evidence, and Judge records the Verdict for the Decision Owner.

Mitigate the single-source supplier this quarter, accept until the dual-source lands, transfer through the contract review, or avoid the launch. If the Verdict favors mitigate and the owner accepts until June, write who accepted and when that acceptance expires.