Risk Treatment Plan
Mandatory – ISO/IEC 27001:2022 cl.6.1.3 e + cl.8.3. For each risk
above the acceptance threshold: option chosen, controls, owner,
timeline, expected residual.
| Field | Value |
|---|
| Period | YYYY cycle |
| Based on | Risk register DOC-ISMS-012 |
| Approved by | Risk owners + management |
Treatment actions
| Risk ID | Risk | Option | Controls (Annex A) | Action plan | Owner | Due | Budget | Residual target |
|---|
| R-001 | Data breach | Mitigate | A.8.3, A.8.24 | Implement MFA + encryption | @name | YYYY-MM | $N | Low |
| R-003 | Lost device | Mitigate | A.8.1, A.7.9 | Full-disk encryption rollout | @name | YYYY-MM | $N | Low |
| R-004 | Vendor outage | Mitigate | A.5.22 | Backup vendor contract | @name | YYYY-MM | $N | Med |
Treatment decisions pending
| Risk ID | Proposed option | Decision needed from | By when |
|---|
| R-0NN | Accept vs treat | Management | YYYY-MM |
Progress tracking
| Checkpoint | Date | Status summary |
|---|
| QN review | YYYY-MM-DD | N% actions complete |
Residual risk acceptance
Risks remaining after treatment require explicit sign-off:
| Risk ID | Residual score | Accepted by | Date | Expiry |
|---|
| R-002 | 3 | @exec | YYYY-MM-DD | review date |
Linkages
- Inputs from: risk register, SoA
- Outputs to: SoA justification, audit evidence, management review