Glossary · ISO and management systems
Four choices, one signature: risk treatment is a decision recorded against each ranked risk.
The step where an organisation decides how to handle each assessed risk, by reducing, avoiding, sharing or accepting it, and records the plan and approval.
Back to the glossary01 · In plain words
In plain words
The step where an organisation decides how to handle each assessed risk, by reducing, avoiding, sharing or accepting it, and records the plan and approval.
Once risks are ranked, someone has to choose what to do. You can cut the risk with controls, stop the activity, share it with an insurer or supplier, or accept it. Risk treatment is that choice, plus a plan for carrying it out and a named person who signed off on what risk is left.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
In ISO 27001 the treatment step under clause 6.1.3 is where Annex A enters: you compare the controls you chose with the full Annex A list so nothing needed is missed, and the result becomes the Statement of Applicability. Clause 8.3 then asks you to carry out the plan and keep the results. An auditor will want to see that risk owners approved the plan and accepted the leftover, or residual, risk. Without that sign-off, risk acceptance looks like neglect.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The risk treatment plan
- Which option was chosen for each risk, the controls involved, the owner and the target date.
- The Statement of Applicability
- The control list that results from treatment, with reasons for including or excluding each Annex A control.
- Clauses 6.1.3 and 8.3 of ISO 27001
- Planning treatment, then performing it; titles only.
- Insurance and supplier contracts
- Where a transferred or shared risk actually lands, and on what terms.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a packaging plant's factory-floor network
The plant's risk assessment flags that its machine controllers run an old operating system that cannot be patched. The team weighs its options. Avoid: replace the line, too costly this year. Reduce: put the controllers on a separate network segment, block internet access and log all remote sessions. Transfer: check that the cyber insurance policy covers production downtime. The plant chooses reduce plus transfer, sets an owner and a date, and the plant head signs that the remaining risk is acceptable until the line is replaced.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Risk acceptance
- Accepting a risk is one treatment option among four, not the whole step. It still needs an owner's recorded approval.
- Remediation
- Remediation fixes a specific finding, such as a vulnerability. Treatment is the broader decision about a risk, which may or may not involve fixing anything.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Record the chosen option for every risk above your acceptance level.
- Get the risk owner, not the security team, to approve residual risk.
- Link each control in the Statement of Applicability back to the risks it treats.
- Track treatment actions to closure and reassess the risk once they are done.
- GuideRisk assessment and treatmentA method that is repeatable, with the records an auditor reads.
- GuideThe Statement of ApplicabilityHow to build the document auditors open first.
- GuideClause 8: operationRunning the risk work you planned, and keeping the evidence.
Sources: ISO/IEC 27001:2022 clause titles 6.1.3 and 8.3 and the Annex A control list (titles only, not quoted); ISO/IEC 27005 at summary level.
Questions about Risk treatment
Can we accept a high risk?
Yes, if the right person signs.
Nothing stops a business from accepting a high risk, but the decision should sit with someone who has the authority to bear the consequence, and the reasons should be written down. Auditors look hard at high risks accepted by junior staff.
Must every control come from Annex A?
No. Annex A is a cross-check.
You may design your own controls or draw them from other frameworks. Annex A is used to check that no necessary control was overlooked, and every Annex A control still needs an entry in the Statement of Applicability saying whether it applies.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.