What is the Akzeptanzlinie ("acceptance line") on a risk matrix, and what does it represent?

A line drawn through the matrix dividing acceptable risks (below/left) from unacceptable ones (above/right). It is the visual representation of the organisation's Schutzziel (protection goal).

The Schutzziel ("protection goal") defines the desired security level — what level of risk the organisation is willing to live with. On the matrix:

• Below the line → acceptable; can be accepted as-is.
• Above the line → unacceptable; must be reduced, transferred, or avoided.

The line isn't horizontal — it's a step-shape, because a highly likely low-impact risk and a rare catastrophic risk are both unacceptable in different ways. Typical shape: certain rows demand control even at low impact; rare events are tolerated up to moderate impact.

Why it's a strategic decision, not a technical one:

• The line position reflects risk appetite — a startup might draw it high (more risk tolerated for speed); a bank draws it low (regulators demand it).
• Different parts of the business may have different lines (customer-data is stricter than internal-tools).

Tip: Two risks plotted at R1 (Possible, Major) and R2 (Possible, Minor): R1 sits above the line → must be treated. R2 sits below → can be accepted.