Definition of Residual Risk:
* Residual risk is the level of risk that remains after all planned controls have been implemented.
Management Implications:
* Organizations must determine whether residual risk falls within acceptable thresholds or requires further action.
Supporting Reference:
* CCISO materials define residual risk as a critical concept in risk management and ongoing security monitoring.

* Governance Levels:
* Individual projects are grouped under programs, which are monitored and managed collectively to achieve specific outcomes or benefits.
* Program vs. Portfolio:
* Programs consist of interrelated projects.
* Portfolios include multiple programs and standalone projects aligned with strategic objectives.
* Why Program Level:
* Projects are tracked at the program level to ensure alignment with overarching goals and efficient resource allocation.
References:
* EC-Council CISO Module: Governance Structures and Monitoring Practices.

Immutable data storage protects against ransomware threats by ensuring that once data is written, it cannot be altered or deleted. This technology prevents ransomware from encrypting or modifying critical backups, enabling rapid restoration. Options B, C, and D are valuable for prevention and awareness but do not provide the direct protection against ransomware that immutable storage offers.
Reference: https://cloud.google.com/blog/products/identity-security/5-pillars-of-protection-to-prevent- ransomware-attacks