What term describes a strategic assessment of what level of residual risk is tolerable for an organization?

What term describes a strategic assessment of what level of residual risk is tolerable for an organization?

• A. Secure baseline
• B. CVSS
• C. Risk tolerance
• D. Vulnerability feed

Answer: (C)

Residual risk and how much of it an organization is willing to accept is described by risk tolerance. After security measures are in place, some risk remains, and risk tolerance sets the concrete threshold for what level of that residual risk is acceptable. It guides decisions to accept the remaining risk, mitigate further, transfer, or avoid it. If the residual risk stays within the tolerance, operations can proceed; if it would exceed the tolerance, additional controls or risk treatment are needed. The other terms don’t capture this decision boundary: a secure baseline is a starting set of controls, CVSS scores vulnerability severity rather than organizational risk thresholds, and a vulnerability feed is just a stream of vulnerability data, not a tolerance level.

Residual risk and how much of it an organization is willing to accept is described by risk tolerance. After security measures are in place, some risk remains, and risk tolerance sets the concrete threshold for what level of that residual risk is acceptable. It guides decisions to accept the remaining risk, mitigate further, transfer, or avoid it. If the residual risk stays within the tolerance, operations can proceed; if it would exceed the tolerance, additional controls or risk treatment are needed. The other terms don’t capture this decision boundary: a secure baseline is a starting set of controls, CVSS scores vulnerability severity rather than organizational risk thresholds, and a vulnerability feed is just a stream of vulnerability data, not a tolerance level.