ISO 27001 requires a risk owner to be identified for every risk in the assessment and to approve the risk treatment plan and the residual risks. In practice that means someone senior enough to commit budget and people, not whoever filled in the spreadsheet.
Control owners are different: they run the control, while the risk owner decides whether the control is enough. See residual risk.
Read more
Related terms
- Risk treatment plan
- A risk treatment plan is the ISO 27001 document recording how each information security risk will be treated, by whom, by when and with which controls.
- Residual risk
- Residual risk is the level of risk that remains after the planned treatment and controls have been applied, which the risk owner must formally accept.
- Risk acceptance
- Risk acceptance is the documented decision by a risk owner to live with a risk, or with the residual risk after treatment, rather than reduce it further.
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.