Residual Risk
PCIComplianceHubLast updated
The remaining risk after an organization has implemented security controls and measures to mitigate identified risks. Understanding and managing residual risk is important for maintaining PCI DSS compliance and ensuring the ongoing security of cardholder data.
Applies to. PCI DSS v4.0.1 does not use the term residual risk. The nearest ideas are the compensating control worksheet, which must state the additional risk a deviation creates and how the compensating control addresses it, and the targeted risk analysis, which justifies how often a control runs and is repeated at least every 12 months. Neither asks the entity to quantify or accept the risk that remains once controls are in place.
Limits. The standard has no risk acceptance route: a requirement is in place, not applicable, met by a compensating control or the Customized Approach, or not in place. Accepting residual risk instead of meeting a requirement is not an option it recognises.
Related. Risk, Risk Management, Compensating Controls, Compensating Control Worksheet (CCW), Targeted Risk Analysis (TRA)
Sources. PCI DSS v4.0.1 (June 2024)