Residual risk

Residual risk is the exposure that is left after an identified information security risk has been treated. It exists because security controls usually reduce a risk rather than eliminate it: technical measures have limits, organisational rules depend on how people actually behave, and driving a risk to zero would often be disproportionately expensive. Practitioners distinguish the inherent or gross risk – the level of exposure before effective controls are taken into account – from the net or residual risk, which reflects the controls already in place plus those newly decided upon. A residual risk is therefore not a failing but the normal, expected outcome of rational risk management.

What matters is how residual risk is handled formally. Clause 6.1.3 of ISO/IEC 27001:2022 requires the organisation to obtain the risk owners' approval of the risk treatment plan and their explicit acceptance of the residual information security risks. The yardstick is the risk acceptance criteria defined in advance: if the residual risk falls below the agreed threshold it can be accepted; if it exceeds the threshold, either another round of treatment is needed or a deliberate, reasoned exception has to be decided at the appropriate management level. The acceptance must be documented in an auditable way – with a date, a named decision-maker, a rationale, a validity period and a reference to the specific risk. Germany's BSI Standard 200-3 makes the same point, stressing that residual risks have to be presented transparently to top management because that is where accountability sits.

Accepting a residual risk is not a permanent sign-off. Residual risks should carry an expiry date, be reviewed regularly and be reported in the management review under clause 9.3 of ISO/IEC 27001, because the threat landscape, business processes and control effectiveness all change over time. The topic has gained further weight through the NIS2 Directive (EU) 2022/2555 and its German implementation: under Articles 20 and 21, the management bodies of essential and important entities must approve the cybersecurity risk management measures, oversee their implementation and can be held personally liable for breaches. An undocumented or unconsidered acceptance of residual risk is therefore not merely an audit finding inside the ISMS but a potential supervisory issue. It should be noted that Germany transposed the NIS2 Directive well after the EU deadline of 17 October 2024, and that individual details and transition arrangements are still being fleshed out through statutory instruments and regulatory guidance.