Step 5 · ISO/IEC 27005:2022, Clause 8
ISO 27005 risk treatment plan: from options to acceptance
Treatment turns a ranked list of risks into decisions and actions. Clause 8 of the standard follows clause 6.1.3 of ISO/IEC 27001 step by step: select an option, determine the controls, compare them with Annex A, produce the statement of applicability, formulate the plan, then have it approved by the risk owners, who accept what remains.
- Clause
- 8, Information security risk treatment process
- Participants
- Risk owners, CISO, CIO, management
- Deliverables
- Statement of applicability, treatment plan, accepted residual risks
Guide chapters
In brief
-
Clause 8 chains five activities: selecting treatment options (8.2), determining all the controls that are necessary (8.3), comparing them with Annex A of ISO/IEC 27001 (8.4), producing the statement of applicability (8.5) and formulating the treatment plan (8.6).
-
There are four options: reduce the risk through controls, avoid it, share it with a third party or retain it knowingly. They can be combined.
-
The comparison with Annex A acts as a safety net: it checks that no necessary control has been overlooked. It does not oblige you to adopt all 93 controls.
-
The plan is approved by the risk owners (8.6.2), who accept the residual risks (8.6.3). Since the 2022 edition, acceptance is the conclusion of treatment.
-
A residual risk above the criteria is not forbidden: it calls for an explicit, reasoned and signed decision at the right level.
Select a treatment option
For each risk to be treated, the owner selects one or more options (8.2). The standard describes four; the labels vary between editions and translations, the idea stays the same.
| Option | What it means | Example | What to watch |
|---|---|---|---|
| Reduce (modify the risk) | Put in place or strengthen controls that lower the likelihood or the consequences | Multi-factor authentication, segmentation, offline backups | The real effectiveness of the control, to be checked |
| Avoid | Give up the activity or practice that creates the risk, or remove its source | Remove a permanent remote access | The new risk the alternative sometimes creates |
| Share | Have part of the risk borne by a third party: insurance, contract, outsourcing | Cyber insurance, liability clause | Accountability stays with the organisation; the third party itself becomes a risk source |
| Retain | Keep the risk as it is, through an informed decision | Low risk, disproportionate cost of treatment | The decision must be recorded and reviewed |
Determine the controls, then compare them with Annex A
Subclause 8.3 asks you to determine all the controls that are necessary to implement the options selected. They can come from any source: Annex A of ISO/IEC 27001, detailed by ISO/IEC 27002, a sector framework, guides from national agencies, or controls designed for your case. You go from the risk to the control, not the other way round.
Subclause 8.4 then asks you to compare these controls with those in Annex A of ISO/IEC 27001:2022. This is the requirement of clause 6.1.3 c): verifying that no necessary control has been omitted. Annex A plays the role of a checklist. If one of its 93 controls addresses a risk you had underestimated, you add it; if it addresses none of your risks and none of your obligations, you exclude it and justify the exclusion.
The statement of applicability
Subclause 8.5 deals with the statement of applicability (SoA), a document required by ISO/IEC 27001. It lists the necessary controls, justifies their inclusion, states whether they are implemented and justifies the exclusion of the Annex A controls that are not adopted. It is derived from risk treatment: an SoA written before the assessment, by ticking off Annex A, reverses the logic the auditor checks.
Formulate the risk treatment plan
Subclause 8.6 deals with the plan: its formulation (8.6.1), its approval by the risk owners (8.6.2) and the acceptance of the residual risks (8.6.3). The plan says, for each risk to be treated, what will be done, by whom and by when.
| Heading | Content |
|---|---|
| Risk addressed | Reference and reminder of the scenario, current level |
| Option | Reduce, avoid, share, retain, or a combination |
| Controls | Actions to carry out, with their link to Annex A where relevant |
| Person responsible and deadline | A named person, a date, the resources allocated |
| Expected residual risk | Consequences, likelihood and level estimated once the controls are in place |
| Follow-up | Progress status, evidence of completion, way of checking effectiveness |
A realistic plan ranks the actions: those that reduce the risk a great deal for a moderate effort go first. Until a control is in place, the risk stays at its initial level; the plan must therefore say what is done in the meantime, for example a temporary control or closer monitoring.
Approve the plan and accept the residual risks
The residual risk is the one that remains after treatment. It is estimated with the same scales as the initial risk, then compared with the acceptance criteria. ISO/IEC 27001 (clause 6.1.3 f) requires you to obtain the risk owners' approval of the plan and their acceptance of the residual risks.
- Approval of the plan commits the owner on the means: budget, availability of teams, constraints accepted by the owner's activity.
- Acceptance of the residual risk is a separate decision: the owner acknowledges what will remain once the plan is carried out, and takes responsibility for it.
- If the residual risk exceeds the criteria, there are two routes: extend the treatment, or accept it by exception, at the level of management provided for in the criteria, with a reason and a review date.
- Everything is written down: who accepted what, when, on the basis of what information. This is the documented information the auditor will ask for.
Running example: Mécanique Vauclair's treatment plan
| Ref. | Option | Controls | Residual risk | Decision |
|---|---|---|---|---|
| R1 Ransomware through remote maintenance | Reduce, share | Remote maintenance access opened on request, named accounts with multi-factor authentication; separation of the workshop and office networks; offline backups tested every quarter; cyber insurance | Consequences 3, likelihood 2: 6, medium | Accepted by the executive committee, annual review |
| R2 Theft of a customer's drawings | Reduce | Access to drawings limited to the designers on the project; multi-factor authentication on email; phishing awareness | Consequences 4, likelihood 1: 4, medium | Accepted by the executive committee |
| R3 Administration error on the ERP | Reduce | Change procedure with prior backup and test; test environment | Consequences 2, likelihood 1: 2, low | Accepted by the CIO |
Frequently asked questions
What is a risk treatment plan?
It is the document that says, for each risk to be treated, which option is chosen, which controls will be put in place, by whom, by when and with what expected residual risk. ISO/IEC 27001 requires it (clause 6.1.3 e), and ISO/IEC 27005 describes its formulation, its approval by the risk owners and the acceptance of residual risks.
What are the risk treatment options?
There are four: reduce the risk by putting controls in place, avoid it by giving up the activity or removing its source, share it with a third party through a contract or insurance, or retain it through an informed decision. Several options can be combined for the same risk.
Do you have to apply every control in Annex A?
No. Controls are determined from risk treatment. Annex A of ISO/IEC 27001 is then used to check that no necessary control has been omitted. An Annex A control can be excluded, provided the exclusion is justified in the statement of applicability.
Who accepts the residual risks?
The risk owners. ISO/IEC 27001 requires you to obtain their approval of the treatment plan and their acceptance of the residual risks. When the residual risk exceeds the acceptance criteria, the decision goes up to the level provided for in those criteria, often top management, and its reasons are given in writing.
Can you accept a risk above the criteria?
Yes, through an explicit decision. Acceptance criteria can provide for a risk above the threshold to be accepted at a higher level of management, for a limited period or with a commitment to treat it later. What is not acceptable is a risk that is kept without anyone having decided it.
Sources
This chapter summarises and rephrases the official publications below. If in doubt, the official text prevails.
- ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection: guidance on managing information security risks (4th edition), ISO, October 2022.
- ISO/IEC 27005:2022, public preview: scope, terms and definitions, table of contents, ISO, Online Browsing Platform.
- ISO/IEC 27001:2022, Information security management systems: requirements, ISO, October 2022.
- ISO/IEC 27002:2022, Information security controls, ISO, February 2022.
- ISO 31000:2018, Risk management: guidelines, ISO, February 2018.
A platform and service that adapt to you
Our platform is designed for fine-tuned configuration and broad adaptability to your needs.