The chapter starts by characterizing the difference between mandated requirements and organizational objectives. It then provides detailed guidance on how to elicit information from stakeholders, decision authorities, and subject matter experts about performance constraints and targets, risk tolerance levels, and risk acceptance levels, toward deriving an overall risk posture that characterizes an organization’s attitudes toward aggregate risks. It also discusses the calibration of expert judgment to reduce biases, by using varying techniques such as the analytical hierarchy process (AHP) and multi-criteria decision analysis (MCDA).