(ISC)2 Certified in Cybersecurity Practice Exam

What is the term for the initial level of risk faced by an organization before any controls are applied?

1. Residual Risk

2. Inherent Risk

3. Operational Risk

4. Adaptive Risk

The correct answer is: Inherent Risk

The term for the initial level of risk faced by an organization before any controls are applied is known as inherent risk. Inherent risk reflects the potential for loss due to vulnerabilities present in the absence of any mitigative measures. It represents the degree of exposure to risk that exists naturally due to an organization’s operations, environment, and activities. Understanding inherent risk is crucial for organizations as it helps them assess their starting risk profile. This initially identified risk sets the baseline from which further analysis and implementation of security controls can occur. Residual risk, conversely, refers to the remaining level of risk after controls have been applied, while operational risk generally pertains to risks arising from internal processes, people, and systems. Adaptive risk is less commonly defined in risk management contexts and does not capture the foundational concept of initial risk assessment as accurately.