Information security risk treatment

What the requirement asks

The risk treatment plan must be put into effect, and documented information on the results of risk treatment must be retained.

What the guidance adds

The treatment plan is expected to be carried out and recorded. The guidance follows each action to its implementation, its owner, its due date and the residual risk. A plan that is approved and never opened again is the most common finding in this clause.

What good looks like

Keep evidence that actions in the risk treatment plan were implemented, such as change or project records with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Treatment implementationEvidence that actions in the risk treatment plan were implemented, such as change or project records
• Treatment implementationRetained records of treatment results and residual risk
• Treatment implementationTracking of treatment actions with owners and dates
• Treatment implementationUpdates to the SoA reflecting implementation status

The question an assessor will ask

An assessor will ask for evidence that actions in the risk treatment plan were implemented, such as change or project records. The test for 8.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• The treatment plan exists but actions are overdue with no follow-up
• No record of treatment results is kept
• SoA status is not updated when controls are implemented
• Residual risk after treatment is never reassessed

Before the next audit

Before the next audit, test this against one live record: the treatment plan exists but actions are overdue with no follow-up.