ISO 27001 Risk Treatment Plan

A risk treatment plan is the second step in the overall risk management process and is usually introduced when the company completes the ISO 27001 risk assessment. While risk assessment is the process of assessing the potential risk, a risk treatment plan includes documenting the actions required to address each risk identified during the assessment process. There are four established risk treatment options that most companies select from when it comes to managing the identified risk. These are acceptance, mitigation, transfer, and avoidance.

The following elements are part and parcel of a certified risk treatment plan.  

1. A summary providing details of every identified risk
2. Specifying the responses that have been chosen for the glossary- ISO 27001 Risk Treatment Plan for each risk
3. Assigning an owner for each identified risk. This includes identifying who is accountable for the assessed risks and mentioning them.
4. Specify the designated risk mitigation activity owners assigned the duty of performing tasks to address these identified risks.
5. A set target completion date for evaluating the effectiveness of risk treatment activities.

This treatment plan helps the company decide which controls are beneficial to assess and tackle risks. Annex A under ISO 27001 is considered an ideal starting point since it contains 114 controls, divided into 14 domains. Each domain is tailored to serve a specific category of information security.