What is the term for risk that remains after vulnerabilities are classified and countermeasures have been deployed?

What is the term for risk that remains after vulnerabilities are classified and countermeasures have been deployed?

• A. Residual risk
• B. Inherent risk
• C. Control risk
• D. Operational risk

Answer: (A)

Residual risk is the risk that remains after vulnerabilities are identified and countermeasures are in place. Even with classification and protections, no control is perfect, and unknown or evolving threats, misconfigurations, or human error can keep some risk alive. This is the risk that organizations monitor, document in their risk registers, and decide whether to accept within their risk tolerance or to add compensating measures for further reduction. Inherent risk is the level of risk present before any controls are applied, and operational risk refers to day-to-day risks from people, processes, and systems.

Residual risk is the risk that remains after vulnerabilities are identified and countermeasures are in place. Even with classification and protections, no control is perfect, and unknown or evolving threats, misconfigurations, or human error can keep some risk alive. This is the risk that organizations monitor, document in their risk registers, and decide whether to accept within their risk tolerance or to add compensating measures for further reduction.

Inherent risk is the level of risk present before any controls are applied, and operational risk refers to day-to-day risks from people, processes, and systems.