Residual Risk
What is Residual Risk?
The risk that remains after controls have been applied. If residual risk exceeds the organisation's risk appetite, additional controls or risk treatment is required.
Related terms
Frameworks that govern residual risk
What the standards actually require on residual risk
Requirements naming residual risk across 6 standards, quoted from the control text.
The security assessor, with the practitioner, summarises risk scenarios and decisions from the design TRA work and the security deficiencies left uncorrected from development, testing and installation, adjusts risk levels to give the risk profile the system wi...
canada-itsg-33-it-security-risk-management::A2-3.9.3 · 3.9.3 Conduct a residual risk assessment →ITSMs should assess threats, vulnerabilities and residual security risks, report on them, and recommend remedial action.
new-zealand-information-security-manual-nzism::3.3.10.C.04 · 3.3.10.C.04 Assess and report threats, vulnerabilities and residual risk →Requirement 0048 (Part Two: Risk, section 6.2.2 Third Party Risk Management; applies to All entities; dated 31 October 2024; retained from Release 2025): Secure and verifiable third-party vendors, providers, partners and associated services are used unless bus...
protective-security-policy-framework-pspf-release-2026::0048 · 0048 Use secure and verifiable vendors; CISO approves residual risk →The residual risk of each zone and conduit is compared with the tolerable risk to decide whether additional countermeasures are needed.
iec-62443::ZCR 5.11 · ZCR 5.11 Compare residual risk with tolerable risk →Verification outcomes must demonstrate that the validation targets for hazardous scenarios already identified are reached, so the risk left over from them is reasonable.
iso-21448-2022::10.7 · 10.7 Evaluation of the residual risk due to known hazardous scenarios →When selecting controls the designer should look specifically for risks a competent builder or user would not be expected to know, identify residual risks and communicate them to the builder and other people controlling later lifecycle stages such as clients a...
australia-model-code-of-practice-safe-design-of-structures::1.4c · 1.4 Select controls with care for residual risk, interaction of hazards and consultation →Questions people ask about residual risk
What is Residual Risk?
Why is Residual Risk important for compliance?
What concepts are related to Residual Risk?
Which compliance frameworks address Residual Risk?
Where can I learn more about Residual Risk?
See how Residual Risk applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.