Which of the following describes residual risk as the risk remaining after risk mitigation has occurred? Response:

DIACAP, the predecessor to the RMF in the DoD, was a comprehensive process that included the concept of residual risk, recognizing that not all risks can be completely eliminated. It required documentation of the risk remaining after the implementation of security controls and mitigation activities.

ISSO (Information System Security Officer) is a role or position, not a framework or process that defines residual risk.

SSAA (System Security Authorization Agreement) was a document used within DIACAP to record the security posture, but DIACAP itself provided the definition of residual risk.

DAA (Designated Approving Authority) is an individual authorized to make authorization decisions, not a process or framework defining risk concepts.