A control effectiveness rating of 'partially effective' in a RCSA means MOST specifically that:
-
A
The control operates as designed but the risk it covers is immaterial
-
B
The control mitigates some but not all of the targeted risk, leaving residual exposure
-
C
Testing was inconclusive due to insufficient sample size
-
D
Management has approved a risk acceptance for the full residual risk