CompTIA SecurityX (CAS-005) CAS-005 — Question 395

An organization that utilizes token-based access for all facilities and systems recently completed an annual review of its security controls. Given the following report: Which of the following is the most important residual risk factor?