What is the term for the amount of risk that remains after vulnerabilities are classified and countermeasures are deployed?

• A. Residual risk
• B. Inherent risk
• C. Calculated risk
• D. Accepted risk

Answer: (A)

Residual risk is the amount of risk that remains after you identify vulnerabilities and implement countermeasures. Even with patches, safeguards, and controls in place, nothing is perfect, so some risk lingers due to imperfect defenses, unknown vulnerabilities, configuration errors, or new threats. This remaining risk is what organizations monitor and decide whether it fits their risk tolerance.

Inherent risk refers to the risk before any controls are applied, so it describes the starting level rather than what’s left after mitigation. Accepted risk is the management decision to tolerate a certain level of residual risk. Calculated risk isn’t the standard term used for describing the post-control risk level.