– It is a threat that balances risk exposure ayer finding and eliminating threats.  – is the risk that remains after controls are accounted for. It’s the risk that remains after your organization has taken proper precautions.  – Three ways to deal with risk are:  1. Reduce it  2. Avoid it  3. Accept it.