Study. uk . com
  1. Home
  2. All questions
  3. Question 259

CISM study material · question 259 of 1000

Which pairing correctly distinguishes residual risk from target residual risk in IR 8286?

  1. Residual risk is what remains after the response is applied; target residual risk is the desired state derived from appetite and tolerance
  2. Residual risk is the desired state the organisation is aiming for; target residual risk is what is actually left once the chosen response has been applied
  3. The two terms are interchangeable
  4. Residual risk applies to systems; target residual risk to the enterprise
Show the answer

Answer: A. Residual risk is what remains after the response is applied; target residual risk is the desired state derived from appetite and tolerance

IR 8286 records residual risk as the post-response assessment, and target residual risk as a desired risk state that the organisation may document based on its risk appetite and tolerance.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Register Elements

Challenge yourself on this topic → Study as cards