When do you accept a vulnerability as an acceptable risk and what classifies is as acceptable?

Many (all?) have said it’s not your concern, it’s about the money/priorities of those who own the risk (maybe a group, maybe the one who holds the budget). That is certainly true, however… as a professional, you can also look at what might be a risk and slip in a fix. Don’t look at me like that - I’m not a cowboy! For instance, DISA publishes guidance and there are various ways to measure how your systems measure up against this guidance. Sometimes systems are just slightly misconfigured and a small change will fix most of them, but break one of them. So push ahead with the fix, letting the system owners know this might happen and work with them to resolve. I do policy for around 500 windows machine and about 175 Linux machines, and it’s surprisingly easy to make a small change to remove a vulnerability with minimal (sometimes, but not always with zero) impact. The big stuff, definitely take note and try to understand impact before making changes (TLS 1.2 for older systems), but understand sometimes things break in the interest of security. Policy is generally uninspired I’ve found, and sometimes you have to work out how to implement with smaller effect (think separation of duties when admins are used to being Domain Admins). Remember you catch more flies with honey, and do in fact sweat the small stuff.