Phase 8: Residual Risk Analysis

Objective

Assess what risk remains after all mitigations are applied. Make explicit risk acceptance decisions and document justifications.

Tools Reference

Review Tools

• list_threats() -- Get all threats with current status
• list_mitigations() -- Get all mitigations with status
• get_threat(id) -- Detailed view including linked mitigations
• get_mitigation(id) -- Detailed view including linked threats

Decision Tools

• update_threat(id, status=...) -- Set final threat status
• add_assumption(description, category, impact, rationale) -- Document risk acceptance

Risk Assessment Framework