Residual risk is the remaining exposure to risk after all preventive measures and controls have been applied. It reflects the level of uncertainty or threat that still exists despite risk mitigation efforts. Organizations must evaluate whether this residual risk is acceptable or if further actions are needed to reduce it to an acceptable level.
