What does residual risk refer to in security risk management?

• A. The remaining risk after mitigations.
• B. The initial risk before any controls.
• C. Risk that cannot be measured.
• D. The risk of compliance only.

Answer: (C)