Risk remaining after security controls and risk treatment measures have been applied.
Residual risk is the risk remaining after treatment measures have been implemented. No control eliminates risk entirely—there's always some remaining exposure. Residual risk should be assessed after implementing controls to verify it's within acceptable tolerance. If residual risk remains unacceptable, additional treatment is needed. Risk acceptance decisions should explicitly acknowledge residual risk levels and be approved at appropriate authority levels.
Why It Matters
The DSC Perspective:
Understanding residual risk prevents false confidence. Controls reduce risk but don't eliminate it. Ensure residual risk is understood and formally accepted by appropriate decision-makers.