ISO 27001:2022 Clause 8.3 Information Security Risk Treatment Explained

In this guide you will learn how to implement ISO 27001 Clause 8.3 Information Security Risk Treatment and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

Key Takeaways

ISO 27001 Clause 8.3 requires organisations to implement the risk treatment plan. While Clause 6.1.3 focuses on planning how to address risks (deciding whether to mitigate, accept, avoid, or transfer), Clause 8.3 is about the execution. This is the “Do” phase of the risk management cycle. You must demonstrate that the decisions made during the planning phase are actively being carried out and that evidence of these actions is retained.

FREE ISO 27001 Clause 8.3 Training Video

What is ISO 27001 Clause 8.3?

ISO 27001 clause 8.3 addresses executing Information Security Risk Treatment. Building upon the risk treatment planning covered in clause 6.1.3, this section focuses on putting those plans into action. For ISO 27001 certification, the standard mandates the effective treatment and management of identified risks. This process requires documented evidence of the risk treatment activities, typically maintained within the risk register.

Definition

ISO 27001 defines ISO 27001 Information Security Risk Treatment as:

The organisation shall implement the information security risk treatment plan. The organisation shall retain documented information of the results of the information security risk treatment.

ISO 27001:2022 Clause 8.3 Information Security Risk Treatment

Risk Treatment Examples

Risk treatment examples include:

• You can accept the risk. You would hold a management review meeting, get agreement to accept the risk, minute the meeting to document the decision and update the risk register.
• You could transfer the risk. Whilst you cannot transfer the accountability for a risk you can transfer the treatment of the risk. An example of this would be having insurance in place or outsourcing to a third party.
• You could mitigate the risk. The level of mitigation may be to reduce but not eliminate the risk or to eliminate the risk. It really depends on the risk appetite of the organisation.

How to implement ISO 27001 Clause 8.3

ISO 27001 clause 8.3 requires proof your risk treatment plan (from clause 6.1.3) is working. You show this by actively managing risks. Use a risk register listing all needed controls and leftover risk. Share this register with management and discuss it in their review meetings.

Your Statement of Applicability controls are meant to handle risk. Make sure your risk register and treatment link to these controls, especially those in your Statement of Applicability.

Implementing ISO 27001 Clause 8.3 is the transition from theoretical risk planning to operational reality. As a Lead Auditor, I look for more than just a plan, I look for the concrete “fingerprints” of execution. Use the following ten steps to ensure your risk treatment is robust, auditor-ready, and technically sound.

1. Formalise the Risk Treatment Plan (RTP)

Translate your strategic decisions from Clause 6.1.3 into a living operational document. Every risk must have a clearly defined treatment path: avoid, mitigate, transfer, or accept.

• Assign every risk to a specific, named Risk Owner.
• Set hard deadlines for control implementation to prevent “compliance drift”.

2. Map Controls to the Statement of Applicability (SoA)

Ensure every treatment action aligns with your Annex A control selection. This creates a direct link between your operational activities and your formal certification scope.

• Cross-reference technical mitigations with specific Annex A controls like A.5.15 (Access Control).
• Document why specific controls were selected as the primary treatment mechanism.

3. Provision Necessary Resources and Budget

Secure the financial and human capital required to execute the treatment plan. Without dedicated resources, risk treatment remains an aspirational goal rather than a business reality.

• Allocate budget for security software, hardware upgrades, or external consultancy.
• Ensure the Management Review Team (MRT) approves resource allocation in meeting minutes.

4. Configure Identity and Access Management (IAM) Roles

Execute technical treatments by hardening your access controls. This step is a critical mitigation for the majority of information security risks related to data breaches.

• Implement the Principle of Least Privilege across all production environments.
• Enforce Multi-Factor Authentication (MFA) for all administrative and remote access points.

5. Update the Asset Register with Protection Status

Link your risk treatments directly to the assets they protect. An auditor needs to see that your treatments are not abstract but are applied to specific hardware and data sets.

• Annotate your Asset Register to show which assets are covered by which risk treatment.
• Verify that asset owners acknowledge and accept their role in the treatment process.

6. Execute Technical Vulnerability Remediation

Address technical risks by operationalising your patch management and vulnerability scanning. This provides the technical evidence (logs) that treatments are active.

• Review vulnerability scan results and apply critical patches within defined SLAs.
• Keep records of system configuration changes as proof of mitigation.

7. Implement Physical and Environmental Controls

Mitigate risks to your physical infrastructure. Clause 8.3 is not limited to software, it encompasses the physical security of your offices and data centres.

• Install or upgrade physical access controls such as biometric readers or CCTV.
• Document the testing of environmental controls like UPS systems and fire suppression.

8. Secure Cyber Insurance and Third-Party Contracts

Formalise risk transfer treatments. If your strategy is to transfer risk, you must have the legal and financial documentation to prove that transfer is valid.

• Finalise Cyber Insurance policies that cover the financial impact of identified risks.
• Insert specific security clauses into vendor contracts to transfer operational risk to third parties.

9. Formalise Management Risk Acceptance

Ensure that all risks marked for “acceptance” are signed off by leadership. Risk acceptance is a governance decision, not a technical oversight.

• Obtain written sign-off from the Risk Owner and Management Review Team for all residual risks.
• Justify why the cost of mitigation outweighs the potential impact of the risk.

10. Document and Retain Evidence of Results

Collate all outputs from the previous steps into a consolidated evidence pack. This is the “documented information” required specifically by the ISO 27001 standard.

• Retain logs, meeting minutes, and configuration reports as audit evidence.
• Use the ISO 27001 Toolkit to organise your evidence for external assessment.

Risk Register Template

Risk Management Policy Template

How to conduct an ISO 27001 risk treatment

• You use the risk register and sure that you provide an effective risk rating for each risk.
• Using your risk treatment plan you will have identified the relevant risk treatment based on risk level.
• This can be overridden by the management review team meeting.
• For each risk that you identify, once you have identified the risk treatment implement the treatment you have chosen. If this is to either introduce or enhance controls, including those in the Statement of Applicability, follow your continual improvement process.
• Once the risk treatment is implemented update the risk register and conduct and audit of the risk again and record the residual risk score.
• This is the new risk score based on the new risk treatment.
• Ideally the risk score will have gone down.
• You would not want to implement a control for a risk that did not positively impact its risk score and go some way to mitigating it.