The risk treatment strategy that indicates the organization is willing to accept the current level of residual risk; a conscious decision to do nothing else to protect an information asset from risk and to accept the outcome from any resulting exploitation.