A board approves the amount of cyber risk the business is willing to take. What is being established?

1. A firewall port list
2. A password hash algorithm
3. Risk appetite
4. A forensic disk image