What it means
Residual risk is what remains after the safeguards you have actually implemented and assessed. It is different from the risk before treatment and from the lower risk you hope to reach after unfinished work. Controls can reduce the chance of an event, its consequences, or both, without removing every possibility of harm.
Record the remaining scenario in ordinary language. Include control coverage, known bypasses, dependencies, and uncertainty. Someone with appropriate authority must decide whether the remainder is acceptable, needs further treatment, or requires stopping the activity. That decision should have review conditions rather than last forever.
AN ILLUSTRATIVE SCENARIO
A factory supplier connection
A manufacturer restricts a supplier's remote maintenance connection to one production cell and requires time-limited approval. This reduces the opportunity for unattended access and limits reachable equipment. Remaining risk includes misuse during an approved session, a compromised maintenance endpoint, and disruption within the permitted cell. Operations and security document those possibilities, arrange session monitoring, and agree to reassess after a supplier change or a failed access review. The new controls improve the position without making the connection risk-free.
Put it to work
- Revisit the original risk scenario using evidence that each selected safeguard is implemented, covers the intended systems, and works.
- Describe what can still go wrong, its plausible consequences, and any assumptions that materially influence the assessment.
- Record the authorized decision, owner, review date, and triggers for reopening it; track unfinished improvements separately from operating controls.
How to check your work
Ask the owner to explain the remaining exposure and acceptance conditions. Compare that explanation with test evidence, open actions, and the current environment rather than the planned design alone.
Connect the ideas
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
- Control
A process, configuration, or technology meant to reduce a named risk or detect a named failure.
- Uncertainty
What you still do not know, written explicitly so it is not filled with false precision.
- Compensating control
An alternative safeguard used in place of a specified control, with evidence that it provides comparable protection for the intended security objective.