Watch this video on YouTube
Which type of testing evaluates whether a security control reduces residual risk below an accepted level?