Clause 6.1.3 gives four options for each risk: modify it with controls, avoid it, share it with a third party such as an insurer or supplier, or retain it. The plan records the chosen option, the controls selected, their owners and target dates, and it must be approved by the risk owners together with the residual risks they accept.
It is the bridge between the risk assessment and the Statement of Applicability, which should list the same controls. The risk assessment guide covers both.
Read more
Related terms
- Risk owner
- A risk owner is the person with the accountability and authority to manage a particular risk, including approving its treatment and accepting what remains.
- Residual risk
- Residual risk is the level of risk that remains after the planned treatment and controls have been applied, which the risk owner must formally accept.
- Risk acceptance
- Risk acceptance is the documented decision by a risk owner to live with a risk, or with the residual risk after treatment, rather than reduce it further.
- Statement of Applicability
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.