Target risk describes the intended residual exposure under the planned treatment. It is an estimate of a future state, not evidence that the improvement has already happened.
State the treatment assumptions
In Target risk, describe the scenario after the recommended measures are implemented. Use Strength, Weakness, Opportunity and Threat to record the capabilities the target relies on, remaining limitations and conditions that could prevent the intended result.
For example, a target might assume that legacy accounts have migrated to individually accountable access with MFA and regular review. State the remaining exposure instead of claiming that the measure eliminates every related risk.
Score the intended residual exposure
Choose the threat/vulnerability cell in Likelihood level and select Impact and the relevant Impact types. The selected cell supplies the configured likelihood value; Risk exposure combines that level with impact and displays the resulting band.
Keep the same scenario boundaries and matrix interpretation used for inherent and current risk. A target is not automatically acceptable merely because it scores lower. Compare it with the organisation's defined criteria and record the decision through the response process.
Save and follow up
Save the assessment and connect its assumptions to the remediation work. Reassess current risk when implementation and evidence justify the change. Do not replace the current result with the target simply because a plan has been created.