The Ultimate Guide to ISO 27001:2022 Clause 8.3 Information Security Risk Treatment

ISO 27001 Information Security Risk Treatment

The ISO 27001 standard requires an organisation to treat risks and to keep evidence of the results.

Watch the Video

In this ISO 27001 tutorial How To Implement ISO 27001 Clause 8.3 Information Security Risk Treatment I show you how to implement it and pass the audit.

What is ISO 27001 Clause 8.3?

ISO 27001 clause 8.3 addresses executing Information Security Risk Treatment. Building upon the risk treatment planning covered in clause 6.1.3, this section focuses on putting those plans into action. For ISO 27001 certification, the standard mandates the effective treatment and management of identified risks. This process requires documented evidence of the risk treatment activities, typically maintained within the risk register.

ISO 27001 Clause 8.3 Definition

ISO 27001 defines ISO 27001 Information Security Risk Treatment as:

The organisation shall implement the information security risk treatment plan.
The organisation shall retain documented information of the results of the information security risk treatment.

ISO 27001:2022 Clause 8.3 Information Security Risk Treatment

How to implement ISO 27001 Clause 8.3

ISO 27001 clause 8.3 requires proof your risk treatment plan (from clause 6.1.3) is working. You show this by actively managing risks. Use a risk register listing all needed controls and leftover risk. Share this register with management and discuss it in their review meetings.

Your Statement of Applicability controls are meant to handle risk. Make sure your risk register and treatment link to these controls, especially those in your Statement of Applicability.

Risk Treatment Examples

Risk treatment examples include:

• You can accept the risk. You would hold a management review meeting, get agreement to accept the risk, minute the meeting to document the decision and update the risk register.

• You could transfer the risk. Whilst you cannot transfer the accountability for a risk you can transfer the treatment of the risk. An example of this would be having insurance in place or outsourcing to a third party.

• You could mitigate the risk. The level of mitigation may be to reduce but not eliminate the risk or to eliminate the risk. It really depends on the risk appetite of the organisation.

ISO 27001 Clause 8.3 Implementation Checklist

1. Prioritise Risk Treatments

Focus on the most important risks first. Don’t try to fix everything at once.

Challenge: Hard to agree on which risks are truly the biggest. Limited resources can make prioritisation tough.

Solution: Use a clear risk scoring system. Involve key people in deciding priorities. Focus on risks with the biggest potential impact.

2. Develop Treatment Plans

For each key risk, make a simple plan. Say what you will do, who will do it, and when it will be done.

Challenge: Plans can become complex and hard to follow. Things change, making plans outdated quickly.

Solution: Keep plans short and to the point. Regularly review and update them. Make sure everyone knows their role.

3. Implement Controls

Put the controls you chose into action. This might be new tech, new rules, or staff training.

Challenge: New controls can be expensive or disruptive. Staff might resist changes to how they work.

Solution: Explain why the changes are needed. Provide good training and support. Choose controls that fit your business.

4. Document Everything

Keep records of your risk treatments. This shows you are serious about security.

Challenge: Lots of paperwork can be a burden. Hard to keep track of everything.

Solution: Use a simple ISO 27001 risk register. Keep it up to date. Make sure everyone can access it.

5. Communicate Clearly

Tell staff about the risks and what you are doing to manage them.

Challenge: Hard to explain complex risks simply. People might not understand why changes are needed.

Solution: Use plain language. Explain the benefits of better security. Answer people’s questions.

6. Monitor Controls

Check that your controls are working as planned. Are they actually reducing the risks?

Challenge: Monitoring can take time and effort. Hard to know if controls are truly effective.

Solution: Use regular checks and tests. Track key metrics. Get feedback from staff.

7. Review Risk Treatments

Regularly check if your risk treatments are still the right ones. Things change, so should your plans.

Challenge: Easy to forget to review things. Risks can change quickly.

Solution: Set a regular review schedule. When something big changes, review the risks again.

8. Manage Residual Risk

Even with good controls, some risk will remain. Accept this and plan for it.

Challenge: Hard to know how much risk is acceptable. Tempting to try to eliminate all risk.

Solution: Decide what level of risk you can live with. Focus on managing the most important remaining risks.

9. Learn from Mistakes

If something goes wrong, learn from it. Update your risk treatments to stop it happening again.

Challenge: People might be afraid to admit mistakes. Hard to find the root cause of problems.

Solution: Create a culture of learning. Focus on fixing problems, not blaming people. Analyse incidents carefully.

10. Get Management Support

Make sure senior managers are involved in risk treatment. They need to provide resources and support.

Challenge: Hard to get management attention. They might not understand the importance of security.

Solution: Explain the business benefits of good security. Keep them informed about key risks. Show them how security helps the business.

ISO 27001 Clause 8.3 Audit Checklist

How to audit ISO 27001 Clause 8.3 Information Security Risk Treatment

1. Assess Risk Assessment Linkage

Verify a clear link between the identified risks from the risk assessment (Clause 8.2) and the chosen risk treatment options. Treatments should directly address the assessed risks.

• Review risk registers and treatment plans
• trace individual risks through to their corresponding treatments
• interview risk owners to confirm understanding of the linkage

2. Review Treatment Option Justification

Confirm that the rationale for selecting a specific risk treatment option is documented and justified. Simply stating the chosen option is insufficient; why that option was chosen is crucial.

• Examine risk treatment documentation
• interview risk owners and management
• look for evidence of analysis that supports the chosen option (e.g., cost-benefit analysis, feasibility studies).

3. Get Evidence of Control Implementation

Verify that the planned controls for mitigating risks have been implemented. This goes beyond just having a policy; it requires evidence of the control’s existence and operation.

• Inspect physical controls
• examine system configurations for technical controls
• review staff training records for awareness controls
• conduct penetration testing and vulnerability scanning
• observe processes in action

4. Test the Effectiveness of Controls

Ensure that controls are regularly tested to confirm they are operating effectively as intended. This should include both technical testing (e.g., penetration testing) and non-technical testing (e.g., process reviews).

• Review penetration test reports vulnerability scan results, audit logs, and other testing documentation.
• Observe control operation, interview staff about control procedures.

5. Ensure Sufficient Resources are Allocated

Verify that adequate resources (financial, human, technical) have been allocated to implement, operate, and maintain the risk treatments and associated controls.

• Review budget documentation
• resource allocation plans, project plans, and training records
• Interview management and relevant staff about resource availability

6. Review Residual Risk Acceptance

Where residual risk remains after treatment, confirm that it has been formally accepted by appropriate management. The level of residual risk should be documented and justified.

• Review risk registers and treatment plans for documented residual risk acceptance
• interview management to confirm understanding and acceptance of residual risk

7. Check the Frequency of Monitoring and Reviews

Ensure that the effectiveness of risk treatments and controls is monitored and reviewed at appropriate frequencies. The frequency should be based on the level of risk and the changing threat landscape.

• Review monitoring logs incident reports, vulnerability scan results, and management review minutes
• Interview risk owners and management about the monitoring process

8. Review Metrics and Measurements

Verify that appropriate metrics are used to measure the effectiveness of risk treatments and controls. These metrics should be quantifiable and provide meaningful insights.

• Review risk treatment plans and monitoring procedures
• examine reports on control effectiveness
• interview risk owners and management about the metrics used

9. Check for a Continual Improvement Process

Ensure that the risk treatment process itself is subject to continual improvement. This includes learning from incidents, audit findings, and changes in the threat landscape.

• Review records of process improvement initiatives
• interview management about improvement activities
• examine how feedback from audits and incidents is used to update the risk treatment process

10. Ensure Communication of Risk Treatment

Verify that information about identified risks and their treatment plans is communicated effectively to relevant stakeholders.

• Review communication plans
• interview stakeholders about their understanding of risks and treatments
• examine evidence of communication (e.g., meeting minutes, reports, emails)
• assess the effectiveness of communication by asking stakeholders about their awareness of key risks and controls

How to conduct an ISO 27001 risk treatment

You use the risk register and sure that you provide an effective risk rating for each risk.

Using your risk treatment plan you will have identified the relevant risk treatment based on risk level.

This can be overridden by the management review team meeting.

For each risk that you identify, once you have identified the risk treatment implement the treatment you have chosen. If this is to either introduce or enhance controls, including those in the Statement of Applicability, follow your continual improvement process.

Once the risk treatment is implemented update the risk register and conduct and audit of the risk again and record the residual risk score.

This is the new risk score based on the new risk treatment.

Ideally the risk score will have gone down.

You would not want to implement a control for a risk that did not positively impact its risk score and go some way to mitigating it.

Risk Register Template

Risk Management Policy Template

Risk Management Process Template

ISO 27001 Clause 8.3 FAQ

Further Reading

For more on planning for risk assessment be sure to read: ISO 27001 Clause 6.12 Information security risk assessment Guide

For more on planning for risk treatment be sure to read: ISO 27001 Clause 6.1.3 Information Security Risk Treatment Guide