Which term describes the risk that remains after applying mitigations and security controls?

Which term describes the risk that remains after applying mitigations and security controls?

• A. Inherent Risk
• B. Residual Risk
• C. Control Risk
• D. Operational Risk

Answer: (B)

The risk that remains after applying mitigations and security controls is residual risk. After identifying the inherent risk—the level of threat exposure before any safeguards—you implement measures to reduce it. The portion that still exists after those safeguards is what you monitor and manage as residual risk. For example, even with encryption and access controls in place, there may still be a small chance of a breach; that remaining chance is residual risk. This differs from inherent risk (risk before controls), operational risk (risks in day-to-day operations), and any term that would describe risk caused by controls themselves failing.

The risk that remains after applying mitigations and security controls is residual risk. After identifying the inherent risk—the level of threat exposure before any safeguards—you implement measures to reduce it. The portion that still exists after those safeguards is what you monitor and manage as residual risk. For example, even with encryption and access controls in place, there may still be a small chance of a breach; that remaining chance is residual risk. This differs from inherent risk (risk before controls), operational risk (risks in day-to-day operations), and any term that would describe risk caused by controls themselves failing.