Controls for the EHR risk are documented, including preventive MFA and compensating monitoring. What assessment comes next?
Select an answer to reveal the explanation.
Short Explanation
After the umbrella is up, ask how wet you still get. That leftover exposure is residual risk — score it once the controls are on the record.
Full Explanation
Residual risk assessment follows control documentation and reflects remaining likelihood and impact given those controls. Preserving inherent context while scoring residual supports treatment decisions. Ignoring control effects, deleting inherent scores, or auto-closing on control existence is incorrect.