ISO 27001 risk treatment plan: options, examples and what auditors check

A risk treatment plan says what you're going to do about each risk that's too high to leave as it is: which controls you'll put in place, who will do it, by when, and what risk is left afterwards. If the risk register is the diagnosis, the treatment plan is the prescription.

Why it matters

Treatment is clause 6.1.3 of ISO/IEC 27001:2022. In summary, it asks you to:

• Choose a treatment option for each risk.
• Decide the controls needed to carry it out, and compare them with Annex A so you haven't missed anything obvious. That comparison produces your Statement of Applicability.
• Write a treatment plan.
• Get the risk owners' approval of the plan and their acceptance of the residual risk: what's left once the controls are in place.

Clause 8.3 then expects you to carry the plan out and keep the results.

The four options

• Reduce (modify): add or improve controls so the risk is lower. Most treatments are this.
• Avoid: stop the activity that causes the risk, for example by retiring an old system.
• Share (transfer): pass part of the risk to someone else, such as an insurer or a supplier with stronger controls. You still own the risk.
• Accept (retain): knowingly live with it, because it's within your acceptance level or the cost of treating it outweighs the benefit. The owner must accept it explicitly.

What an auditor looks for

• Every risk above your acceptance level has a treatment, or a recorded decision to accept it.
• Each action has an owner and a date, and the auditor can see progress, not just a plan.
• Residual risk is scored and accepted by the risk owner, not by whoever happened to edit the record.
• The controls in the plan appear in your Statement of Applicability, marked as applicable, with their status.
• Treatments are effective. At stage 2 the auditor may test a control your plan relies on, such as asking to see MFA enforced or a restore test record.

Common reasons it fails: plans with no dates that never move; residual risk that nobody accepted; or a treatment that's marked done when the control was only partly put in.

A worked example

Illustrative, for a fictional company:

Risk: a stolen admin password exposes customer data (score 15, above the acceptance level of 10). Option: reduce. Actions: enforce MFA on all admin accounts (Head of Engineering, by 30 November); restrict admin access to managed devices (IT lead, by 15 December); alert on new admin sign-ins (IT lead, by 15 December). Controls: Annex A 5.17 authentication information, 8.5 secure authentication, 8.16 monitoring activities. Residual: score 5, accepted by the Head of Engineering once all three actions are done.

Common mistakes, and how to keep it manageable

• One giant action per risk. Break treatments into actions small enough to finish, each with an owner and date.
• Treating everything. Accepting low risks is a valid, auditable decision. Spend effort where the score is high.
• Duplicating actions across risks. If MFA treats five risks, plan it once and link it to all five, rather than five copies that drift apart.
• Closing on intent. Mark a treatment done when the control works, and keep the evidence that it does.
• Not rescoring. After treatment, rescore the risk, so the register shows the result.

How to do it in ClearIMS

1. Review the drafted treatments. ClearIMS drafts risk treatments as part of your first ISMS. Read each one against the risk it treats and edit it to fit how you work.
2. Open Treatment plans and set an owner and due date for each action. Actions become tasks, and ClearIMS emails owners when they're due or overdue. They can reply in plain text and the record updates.
3. Link the controls. Make sure the controls a treatment relies on are applicable in your Statement of Applicability.
4. Rescore and accept. When the work is done, rescore the residual risk. The risk owner approves the treatment and accepts the residual risk as a separate step. The AI never approves anything.

Related pages

• Risk register: where each treatment starts.
• Statement of Applicability: the controls your treatments put in place.
• Exceptions: when you accept a risk outside the usual rules.
• Tasks: where treatment actions are tracked day to day.