Residual risk is the risk that remains after mitigation measures or security controls are implemented. It may be risk an organization is willing to accept or cannot eliminate. section 6.3.2
Control selection starts with the information system’s confidentiality, integrity, and availability needs, risk posture, and legal or regulatory considerations. After implementation, assess whether the controls achieve the expected risk reduction. System owners then review the controls and sign off at authorization—a risk-based decision about what remains. section 5.3
Do not mistake an initial estimate for residual risk
A trading platform estimates that one hour of downtime costs $100,000 and that a similar denial-of-service attack occurs once every two years. Its illustrated annualized loss expectancy is $50,000. That estimate alone does not establish residual risk: the effectiveness of implemented controls must also be assessed. section 6.3.2 section 5.3
Continue monitoring controls after authorization. Changes in threats, vulnerabilities, effects, or business goals can change the risk level and call for a new assessment. section 5.3
