Canada ITSG-33 - IT Security Risk Management A2-3.9.3: 3.9.3 Conduct a residual risk assessment

The security assessor, with the practitioner, summarises risk scenarios and decisions from the design TRA work and the security deficiencies left uncorrected from development, testing and installation, adjusts risk levels to give the risk profile the system will operate under, and documents it in a residual risk assessment report (optionally consolidated into a TRA report). Each outstanding deficiency must have a request-for-change record in change management rather than a separate safeguard plan.