Literally, it means risk that remains. In infosec domain, it means acceptable risk for the company. ...