Residual risk is the risk remaining after controls have been applied and the assessment has been revisited.
Answer
true
Explanation
### Why this is right
Residual risk describes what remains after risk-reducing controls are applied. Reassessment is needed because controls may reduce risk without eliminating it.
### The concept
An initial risk rating represents risk before the selected controls are accounted for. Controls may be technical, such as a security mechanism, or administrative, such as an organizational procedure. The organization then assesses the remaining exposure rather than assuming that implementing a control removed all risk.
### Terms
- **Residual risk**: Risk remaining after controls are applied.
- **Control**: A measure intended to reduce risk.
### Remember
After applying a control, reassess rather than assuming risk is gone.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free