Information security risk treatment

What the requirement asks

The organization must define and use a risk treatment process to choose suitable treatment options in light of the assessment results; determine every control needed to implement the chosen options (controls can be designed or taken from any source); compare those controls with Annex A to check nothing necessary has been left out (Annex A lists possible controls and is not exhaustive); produce a Statement of Applicability listing the necessary controls, why each is included, whether each is implemented, and why any Annex A control is excluded; draw up a risk treatment plan; and get risk owners to approve the plan and accept the residual risks. Documented information about the process must be retained. The process aligns with the principles and guidelines of ISO 31000.

What the guidance adds

Treatment is expected to produce a plan and a defensible Statement of Applicability. The guidance follows the choice of option, the controls determined, the comparison with Annex A, the reasons for inclusion and exclusion and the risk owner's acceptance of what remains. The SoA should read as a set of decisions, not a copy of the annex.

What good looks like

Keep A risk treatment plan showing the option chosen and the controls determined for each risk with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Risk treatmentA risk treatment plan showing the option chosen and the controls determined for each risk
• Risk treatmentThe Statement of Applicability listing necessary controls, inclusion justifications, implementation status and justifications for each excluded Annex A control
• Risk treatmentEvidence of the comparison of determined controls with Annex A
• Risk treatmentRisk owner approval of the treatment plan and signed acceptance of residual risks

The question an assessor will ask

An assessor will ask for A risk treatment plan showing the option chosen and the controls determined for each risk. The test for 6.1.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• The SoA justifications are generic and not linked to risks
• Exclusions of Annex A controls are unjustified
• Residual risk is accepted by the security team instead of risk owners
• Implementation status in the SoA does not match reality

Before the next audit

Before the next audit, test this against one live record: the soa justifications are generic and not linked to risks.