After patching systems and enabling multi-factor authentication (MFA), an organization reassesses its remaining exposure. What is it measuring?

### Why this is right Residual risk is the risk that remains after controls have been applied. Patching and multi-factor authentication (MFA) are controls, so a later reassessment measures the remaining risk. ### The concept Initial risk is assessed before the controls in question are applied. Controls reduce risk by addressing weaknesses or making exploitation harder. They do not guarantee that all risk disappears, so the organization reassesses and records the residual risk. ### The other options - **A. Initial risk**: This is assessed before applying the controls, so it does not describe the post-control reassessment. - **C. Threat identification**: This names possible harmful actors or events rather than evaluating remaining exposure. - **D. Asset ownership**: This records accountability for an asset, not risk after treatment. ### Terms - **Multi-factor authentication (MFA)**: A login method requiring more than one form of verification. - **Patch**: A software update intended to correct or improve a system. ### Remember “After controls” is the key clue for residual risk.