What is residual risk?

a. All of the listed choices are correct.
b. Unacceptable risks which must be mitigated.
c. Leftover risk that cannot be categorized as operational, managerial, or technical.
d. Risks that remain after security controls have been applied.