# Risk Treatment Plan

> Mandatory – ISO/IEC 27001:2022 cl.6.1.3 e + cl.8.3. For each risk
> above the acceptance threshold: option chosen, controls, owner,
> timeline, expected residual.

| Field | Value |
|-------|-------|
| Period | YYYY cycle |
| Based on | Risk register DOC-ISMS-012 |
| Approved by | Risk owners + management |

## Treatment actions

| Risk ID | Risk | Option | Controls (Annex A) | Action plan | Owner | Due | Budget | Residual target |
|---------|------|--------|--------------------|-------------|-------|-----|--------|-----------------|
| R-001 | Data breach | Mitigate | A.8.3, A.8.24 | Implement MFA + encryption | @name | YYYY-MM | $N | Low |
| R-003 | Lost device | Mitigate | A.8.1, A.7.9 | Full-disk encryption rollout | @name | YYYY-MM | $N | Low |
| R-004 | Vendor outage | Mitigate | A.5.22 | Backup vendor contract | @name | YYYY-MM | $N | Med |

## Treatment decisions pending

| Risk ID | Proposed option | Decision needed from | By when |
|---------|-----------------|----------------------|---------|
| R-0NN | Accept vs treat | Management | YYYY-MM |

## Progress tracking

| Checkpoint | Date | Status summary |
|------------|------|----------------|
| QN review | YYYY-MM-DD | N% actions complete |

## Residual risk acceptance

Risks remaining after treatment require explicit sign-off:

| Risk ID | Residual score | Accepted by | Date | Expiry |
|---------|----------------|-------------|------|--------|
| R-002 | 3 | @exec | YYYY-MM-DD | review date |

## Linkages

- Inputs from: risk register, SoA
- Outputs to: SoA justification, audit evidence, management review