Which of the following describes residual risk as the risk remaining after risk mitigation has occurred?

DIACAP is the Department of Defense process for certifying and accrediting information systems, and it formally defines residual risk as the level of risk that persists after security controls have been implemented and risk mitigation measures have been applied. The Designated Accrediting Authority (DAA) uses this residual risk determination to decide whether to grant accreditation and whether the remaining risk is acceptable for mission operations. DIACAP provides the structured, end-to-end process for evaluating, documenting, and accepting residual risk in DoD information systems.

ISSO (Information System Security Officer) is a personnel role responsible for day-to-day security oversight of a system, not a framework or document that defines the concept of residual risk.

SSAA (System Security Authorization Agreement) is a DIACAP document that captures system security requirements and controls but does not itself define residual risk as a conceptual term.

DAA (Designated Accrediting Authority) is a role that accepts risk on behalf of the organization under DIACAP, not a framework or standard that defines what residual risk means.