Occurs when we calculate the risk after applying our mitigations and security controls.

Occurs when we calculate the risk after applying our mitigations and security controls.

• A. Inherent Risk
• B. Residual Risk
• C. Operational Risk
• D. Threat

Answer: (B)

After you implement mitigations and security controls, you assess what risk still remains. This remaining risk is called residual risk. It represents the level of risk that persists even with safeguards in place. Inherent risk, by contrast, is the risk present before any controls are applied. Operational risk refers to risks arising from day-to-day operations and processes, not specifically the amount of risk left after controls. A threat is a potential cause of harm, not the amount of risk after defenses are applied. So the situation described—risk calculated after applying mitigations and security controls—aligns with residual risk.

After you implement mitigations and security controls, you assess what risk still remains. This remaining risk is called residual risk. It represents the level of risk that persists even with safeguards in place. Inherent risk, by contrast, is the risk present before any controls are applied. Operational risk refers to risks arising from day-to-day operations and processes, not specifically the amount of risk left after controls. A threat is a potential cause of harm, not the amount of risk after defenses are applied. So the situation described—risk calculated after applying mitigations and security controls—aligns with residual risk.