Phase 8 Residual Risk

Phase 8: Residual Risk Analysis

Objective

Assess what risk remains after all mitigations are applied. Make explicit risk acceptance decisions and document justifications.

Tools Reference

Review Tools

• list_threats() -- Get all threats with current status
• list_mitigations() -- Get all mitigations with status
• get_threat(id) -- Detailed view including linked mitigations
• get_mitigation(id) -- Detailed view including linked threats

Decision Tools

• update_threat(id, status=...) -- Set final threat status
• add_assumption(description, category, impact, rationale) -- Document risk acceptance

Risk Assessment Framework

For each threat, consider:

1. Mitigations in place: What controls address this threat? 2. Mitigation effectiveness: How well do the controls work? 3. Residual likelihood: After controls, how likely is the threat? 4. Residual impact: If it still occurs, what's the damage? 5. Business tolerance: Can the business accept this level of risk?

Final Threat Status Decisions

Decision Guide

Mark as threatResolved when:

• Preventive controls fully address the threat vector
• Detective + corrective controls provide adequate response
• Code validation confirmed implementation
• Industry-standard controls are in place

Mark as threatResolvedNotUseful when:

• The threat scenario is unrealistic for this system
• Business has formally accepted the risk with justification
• The threat is blocked by architectural constraints

Keep as threatIdentified when:

• Controls are planned but not implemented
• Partial mitigation leaves significant residual risk
• No cost-effective mitigation exists yet

Workflow

1. Call `get_phase_8_guidance()` 2. Call `list_threats()` to get the full inventory 3. For each threat: a. Call get_threat(id) to see linked mitigations b. Assess residual risk considering mitigation effectiveness c. Call update_threat(id, status=...) with appropriate status 4. Document risk acceptance with add_assumption():

• "Risk of DDoS accepted: CDN and auto-scaling provide adequate protection"
• "SQL injection risk resolved: all database queries use parameterized statements"

5. Review summary with list_threats(status="threatIdentified") to see remaining open risks

Completion Criteria

• [ ] Every threat reviewed for residual risk
• [ ] Final status set on each threat
• [ ] Risk acceptance assumptions documented with business justification
• [ ] No threats left without a deliberate status decision
• [ ] Call advance_phase() to proceed to Phase 9

Common Pitfalls

• Marking all threats as resolved without justification
• Not documenting WHY a risk is accepted
• Forgetting to consider combined/cascading risks
• Ignoring threats that lack mitigations