Table of contents
ISO 27001 Information Security Risk Treatment
The ISO 27001 standard requires an organisation to treat risks and to keep evidence of the results.
What is ISO 27001 Clause 8.3?
ISO 27001 clause 8.3 addresses executing Information Security Risk Treatment. Building upon the risk treatment planning covered in clause 6.1.3, this section focuses on putting those plans into action. For ISO 27001 certification, the standard mandates the effective treatment and management of identified risks. This process requires documented evidence of the risk treatment activities, typically maintained within the risk register.
Definition
ISO 27001 defines ISO 27001 Information Security Risk Treatment as:
The organisation shall implement the information security risk treatment plan.
ISO 27001:2022 Clause 8.3 Information Security Risk Treatment
The organisation shall retain documented information of the results of the information security risk treatment.
What are the ISO 27001:2022 Changes to ISO 27001 Information Security Risk Treatment?
Great news. There are no changes to ISO 27001 Clause 8.3 in the 2022 update.
DO IT YOURSELF ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
Implementation Guide
ISO 27001 clause 8.3 requires proof your risk treatment plan (from clause 6.1.3) is working. You show this by actively managing risks. Use a risk register listing all needed controls and leftover risk. Share this register with management and discuss it in their review meetings.
Your Statement of Applicability controls are meant to handle risk. Make sure your risk register and treatment link to these controls, especially those in your Statement of Applicability.
Risk Treatment Examples
Risk treatment examples include:
- You can accept the risk. You would hold a management review meeting, get agreement to accept the risk, minute the meeting to document the decision and update the risk register.
- You could transfer the risk. Whilst you cannot transfer the accountability for a risk you can transfer the treatment of the risk. An example of this would be having insurance in place or outsourcing to a third party.
- You could mitigate the risk. The level of mitigation may be to reduce but not eliminate the risk or to eliminate the risk. It really depends on the risk appetite of the organisation.
Implementation Checklist
Prioritise Risk Treatments
Focus on the most important risks first. Don’t try to fix everything at once.
Challenge: Hard to agree on which risks are truly the biggest. Limited resources can make prioritisation tough.
Solution: Use a clear risk scoring system. Involve key people in deciding priorities. Focus on risks with the biggest potential impact.
Develop Treatment Plans
For each key risk, make a simple plan. Say what you will do, who will do it, and when it will be done.
Challenge: Plans can become complex and hard to follow. Things change, making plans outdated quickly.
Solution: Keep plans short and to the point. Regularly review and update them. Make sure everyone knows their role.
Implement Controls
Put the controls you chose into action. This might be new tech, new rules, or staff training.
Challenge: New controls can be expensive or disruptive. Staff might resist changes to how they work.
Solution: Explain why the changes are needed. Provide good training and support. Choose controls that fit your business.
Document Everything
Keep records of your risk treatments. This shows you are serious about security.
Challenge: Lots of paperwork can be a burden. Hard to keep track of everything.
Solution: Use a simple ISO 27001 risk register. Keep it up to date. Make sure everyone can access it.
Communicate Clearly
Tell staff about the risks and what you are doing to manage them.
Challenge: Hard to explain complex risks simply. People might not understand why changes are needed.
Solution: Use plain language. Explain the benefits of better security. Answer people’s questions.
Monitor Controls
Check that your controls are working as planned. Are they actually reducing the risks?
Challenge: Monitoring can take time and effort. Hard to know if controls are truly effective.
Solution: Use regular checks and tests. Track key metrics. Get feedback from staff.
Review Risk Treatments
Regularly check if your risk treatments are still the right ones. Things change, so should your plans.
Challenge: Easy to forget to review things. Risks can change quickly.
Solution: Set a regular review schedule. When something big changes, review the risks again.
Manage Residual Risk
Even with good controls, some risk will remain. Accept this and plan for it.
Challenge: Hard to know how much risk is acceptable. Tempting to try to eliminate all risk.
Solution: Decide what level of risk you can live with. Focus on managing the most important remaining risks.
Learn from Mistakes
If something goes wrong, learn from it. Update your risk treatments to stop it happening again.
Challenge: People might be afraid to admit mistakes. Hard to find the root cause of problems.
Solution: Create a culture of learning. Focus on fixing problems, not blaming people. Analyse incidents carefully.
Get Management Support
Make sure senior managers are involved in risk treatment. They need to provide resources and support.
Challenge: Hard to get management attention. They might not understand the importance of security.
Solution: Explain the business benefits of good security. Keep them informed about key risks. Show them how security helps the business.
Audit Checklist
The following is a summary of the ISO 27001 Clause 8.3 Audit Checklist:
Check Risk Treatment Plans
Look at the plans for treating key risks. Are they clear and complete?
Audit Technique: Review documented risk treatment plans. Check if they state what will be done, who’s responsible, and when it will happen.
Verify Control Implementation
See if the planned security controls are actually in place.
Audit Technique: Conduct site visits. Examine system configurations. Interview staff to confirm controls are being used. Review evidence like access logs.
Examine Control Effectiveness
Check if the controls are working as intended. Are they reducing the risks?
Audit Technique: Review vulnerability scan results. Analyse penetration testing reports. Check incident records. Interview staff about control effectiveness.
Review Risk Register
Look at the risk register. Is it up to date and accurate?
Audit Technique: Examine the risk register. Check if it lists all key risks, planned treatments, and residual risk levels.
Check Documented Evidence
Is there proof of risk treatment activities?
Audit Technique: Review meeting minutes, training records, and change management logs. Check for evidence of control implementation and testing.
Interview Staff
Talk to staff about their understanding of risk treatments.
Audit Technique: Conduct interviews with staff at different levels. Ask about their roles in risk management and their understanding of controls.
Observe Processes
Watch how staff carry out tasks related to risk treatment.
Audit Technique: Conduct walkthroughs of key processes. Observe staff performing tasks. Check if they follow documented procedures.
Check Monitoring Activities
Are controls being monitored regularly? How are the results used?
Audit Technique: Review monitoring logs and reports. Check if they are analysed and acted upon. Interview staff about monitoring procedures.
Review Management Reviews
Are risk treatment plans discussed in management review meetings?
Audit Technique: Examine meeting minutes from management reviews. Check if risk management is a regular agenda item.
Verify Residual Risk Management
How are remaining risks being managed? Is the level of risk acceptable?
Audit Technique: Review risk acceptance documentation. Check if residual risks are documented and regularly reviewed. Interview management about risk appetite.
How to conduct an ISO 27001 risk treatment
You use the risk register and sure that you provide an effective risk rating for each risk.
Using your risk treatment plan you will have identified the relevant risk treatment based on risk level.
This can be overridden by the management review team meeting.
For each risk that you identify, once you have identified the risk treatment implement the treatment you have chosen. If this is to either introduce or enhance controls, including those in the Statement of Applicability, follow your continual improvement process.
Once the risk treatment is implemented update the risk register and conduct and audit of the risk again and record the residual risk score.
This is the new risk score based on the new risk treatment.
Ideally the risk score will have gone down.
You would not want to implement a control for a risk that did not positively impact its risk score and go some way to mitigating it.
Watch the Tutorial
Watch How To Implement ISO 27001 Clause 8.3 Information Security Risk Treatment
ISO 27001 Templates
ISO 27001 templates are a great way to implement your information security management system. Whilst an ISO 27001 toolkit can save you up to 30x in consulting fees and allow you to deliver up to 10x faster these individual templates help meet the specific requirements of ISO 27001 clause 8.3.
Risk Register Template
Risk Management Policy Template
Risk Management Process Template
ISO 27001 Clause 8.3 FAQ
The ISO 27001 standard requires an organisation to perform risk treatment for identified risks and record evidence of the risk treatment.
You can download ISO 27001 Clause 8.3 Information Security Risk Treatment templates in the ISO 27001 Toolkit.
An example of ISO 27001 Clause 8.3 Information Security Risk Treatment can be found in the ISO 27001 Toolkit.
Yes. A complete guide to the ISO 27001 Clause 8.3 Information Security Risk Treatment risk register can be found here.
A guide to the ISO 27001 risk management policy used by ISO 27001 Clause 8.3 is located here.
There are several ways to keep and how evidence of a risk assessment:
1. Hold an annual risk review meeting and minute the results
2. Maintain and use a risk register
3. Follow the structure agenda of the management review team meeting which covers risk assessment
4. Include risk assessment as part of your operational processes
At any point that the risk identified is unacceptable and needs to be addressed
Read the complete guide to ISO 27001 risk assessment here.
Further Reading
ISO 27001 Clause 8.3 Audit Checklist
For more on planning for risk assessment be sure to read: ISO 27001 Clause 6.12 Information security risk assessment Guide
For more on planning for risk treatment be sure to read: ISO 27001 Clause 6.1.3 Information Security Risk Treatment Guide
