ISO 27001 Information Security Risk Treatment
Table of contents
- ISO 27001 Information Security Risk Treatment
- What is ISO 27001 Clause 8.3?
- ISO 27001 Clause 8.3 Definition
- How to implement ISO 27001 Clause 8.3
- Risk Treatment Examples
- ISO 27001 Clause 8.3 Implementation Checklist
- ISO 27001 Clause 8.3 Audit Checklist
- How to conduct an ISO 27001 risk treatment
- Risk Register Template
- Risk Management Policy Template
- Risk Management Process Template
- Watch the Video
- ISO 27001 Clause 8.3 FAQ
- Further Reading
What is ISO 27001 Clause 8.3?
ISO 27001 clause 8.3 addresses executing Information Security Risk Treatment. Building upon the risk treatment planning covered in clause 6.1.3, this section focuses on putting those plans into action. For ISO 27001 certification, the standard mandates the effective treatment and management of identified risks. This process requires documented evidence of the risk treatment activities, typically maintained within the risk register.
ISO 27001 Clause 8.3 Definition
ISO 27001 defines ISO 27001 Information Security Risk Treatment as:
The organisation shall implement the information security risk treatment plan.
ISO 27001:2022 Clause 8.3 Information Security Risk Treatment
The organisation shall retain documented information of the results of the information security risk treatment.
DO IT YOURSELF ISO 27001
Finally! Implement ISO 27001 yourself without spending a penny on consultants or software.
How to implement ISO 27001 Clause 8.3
ISO 27001 clause 8.3 requires proof your risk treatment plan (from clause 6.1.3) is working. You show this by actively managing risks. Use a risk register listing all needed controls and leftover risk. Share this register with management and discuss it in their review meetings.
Your Statement of Applicability controls are meant to handle risk. Make sure your risk register and treatment link to these controls, especially those in your Statement of Applicability.
Risk Treatment Examples
Risk treatment examples include:
- You can accept the risk. You would hold a management review meeting, get agreement to accept the risk, minute the meeting to document the decision and update the risk register.
- You could transfer the risk. Whilst you cannot transfer the accountability for a risk you can transfer the treatment of the risk. An example of this would be having insurance in place or outsourcing to a third party.
- You could mitigate the risk. The level of mitigation may be to reduce but not eliminate the risk or to eliminate the risk. It really depends on the risk appetite of the organisation.
ISO 27001 Clause 8.3 Implementation Checklist
1. Prioritise Risk Treatments
Focus on the most important risks first. Don’t try to fix everything at once.
Challenge: Hard to agree on which risks are truly the biggest. Limited resources can make prioritisation tough.
Solution: Use a clear risk scoring system. Involve key people in deciding priorities. Focus on risks with the biggest potential impact.
2. Develop Treatment Plans
For each key risk, make a simple plan. Say what you will do, who will do it, and when it will be done.
Challenge: Plans can become complex and hard to follow. Things change, making plans outdated quickly.
Solution: Keep plans short and to the point. Regularly review and update them. Make sure everyone knows their role.
3. Implement Controls
Put the controls you chose into action. This might be new tech, new rules, or staff training.
Challenge: New controls can be expensive or disruptive. Staff might resist changes to how they work.
Solution: Explain why the changes are needed. Provide good training and support. Choose controls that fit your business.
4. Document Everything
Keep records of your risk treatments. This shows you are serious about security.
Challenge: Lots of paperwork can be a burden. Hard to keep track of everything.
Solution: Use a simple ISO 27001 risk register. Keep it up to date. Make sure everyone can access it.
5. Communicate Clearly
Tell staff about the risks and what you are doing to manage them.
Challenge: Hard to explain complex risks simply. People might not understand why changes are needed.
Solution: Use plain language. Explain the benefits of better security. Answer people’s questions.
6. Monitor Controls
Check that your controls are working as planned. Are they actually reducing the risks?
Challenge: Monitoring can take time and effort. Hard to know if controls are truly effective.
Solution: Use regular checks and tests. Track key metrics. Get feedback from staff.
7. Review Risk Treatments
Regularly check if your risk treatments are still the right ones. Things change, so should your plans.
Challenge: Easy to forget to review things. Risks can change quickly.
Solution: Set a regular review schedule. When something big changes, review the risks again.
8. Manage Residual Risk
Even with good controls, some risk will remain. Accept this and plan for it.
Challenge: Hard to know how much risk is acceptable. Tempting to try to eliminate all risk.
Solution: Decide what level of risk you can live with. Focus on managing the most important remaining risks.
9. Learn from Mistakes
If something goes wrong, learn from it. Update your risk treatments to stop it happening again.
Challenge: People might be afraid to admit mistakes. Hard to find the root cause of problems.
Solution: Create a culture of learning. Focus on fixing problems, not blaming people. Analyse incidents carefully.
10. Get Management Support
Make sure senior managers are involved in risk treatment. They need to provide resources and support.
Challenge: Hard to get management attention. They might not understand the importance of security.
Solution: Explain the business benefits of good security. Keep them informed about key risks. Show them how security helps the business.
ISO 27001 Clause 8.3 Audit Checklist
How to audit ISO 27001 Clause 8.3 Information Security Risk Treatment
1. Assess Risk Assessment Linkage
Verify a clear link between the identified risks from the risk assessment (Clause 8.2) and the chosen risk treatment options. Treatments should directly address the assessed risks.
- Review risk registers and treatment plans
- trace individual risks through to their corresponding treatments
- interview risk owners to confirm understanding of the linkage
2. Review Treatment Option Justification
Confirm that the rationale for selecting a specific risk treatment option is documented and justified. Simply stating the chosen option is insufficient; why that option was chosen is crucial.
- Examine risk treatment documentation
- interview risk owners and management
- look for evidence of analysis that supports the chosen option (e.g., cost-benefit analysis, feasibility studies).
3. Get Evidence of Control Implementation
Verify that the planned controls for mitigating risks have been implemented. This goes beyond just having a policy; it requires evidence of the control’s existence and operation.
- Inspect physical controls
- examine system configurations for technical controls
- review staff training records for awareness controls
- conduct penetration testing and vulnerability scanning
- observe processes in action
4. Test the Effectiveness of Controls
Ensure that controls are regularly tested to confirm they are operating effectively as intended. This should include both technical testing (e.g., penetration testing) and non-technical testing (e.g., process reviews).
- Review penetration test reports vulnerability scan results, audit logs, and other testing documentation.
- Observe control operation, interview staff about control procedures.
5. Ensure Sufficient Resources are Allocated
Verify that adequate resources (financial, human, technical) have been allocated to implement, operate, and maintain the risk treatments and associated controls.
- Review budget documentation
- resource allocation plans, project plans, and training records
- Interview management and relevant staff about resource availability
6. Review Residual Risk Acceptance
Where residual risk remains after treatment, confirm that it has been formally accepted by appropriate management. The level of residual risk should be documented and justified.
- Review risk registers and treatment plans for documented residual risk acceptance
- interview management to confirm understanding and acceptance of residual risk
7. Check the Frequency of Monitoring and Reviews
Ensure that the effectiveness of risk treatments and controls is monitored and reviewed at appropriate frequencies. The frequency should be based on the level of risk and the changing threat landscape.
- Review monitoring logs incident reports, vulnerability scan results, and management review minutes
- Interview risk owners and management about the monitoring process
8. Review Metrics and Measurements
Verify that appropriate metrics are used to measure the effectiveness of risk treatments and controls. These metrics should be quantifiable and provide meaningful insights.
- Review risk treatment plans and monitoring procedures
- examine reports on control effectiveness
- interview risk owners and management about the metrics used
9. Check for a Continual Improvement Process
Ensure that the risk treatment process itself is subject to continual improvement. This includes learning from incidents, audit findings, and changes in the threat landscape.
- Review records of process improvement initiatives
- interview management about improvement activities
- examine how feedback from audits and incidents is used to update the risk treatment process
10. Ensure Communication of Risk Treatment
Verify that information about identified risks and their treatment plans is communicated effectively to relevant stakeholders.
- Review communication plans
- interview stakeholders about their understanding of risks and treatments
- examine evidence of communication (e.g., meeting minutes, reports, emails)
- assess the effectiveness of communication by asking stakeholders about their awareness of key risks and controls
How to conduct an ISO 27001 risk treatment
You use the risk register and sure that you provide an effective risk rating for each risk.
Using your risk treatment plan you will have identified the relevant risk treatment based on risk level.
This can be overridden by the management review team meeting.
For each risk that you identify, once you have identified the risk treatment implement the treatment you have chosen. If this is to either introduce or enhance controls, including those in the Statement of Applicability, follow your continual improvement process.
Once the risk treatment is implemented update the risk register and conduct and audit of the risk again and record the residual risk score.
This is the new risk score based on the new risk treatment.
Ideally the risk score will have gone down.
You would not want to implement a control for a risk that did not positively impact its risk score and go some way to mitigating it.
Risk Register Template
Risk Management Policy Template
Risk Management Process Template
Watch the Video
For a complete visual guide to this process, check out our video tutorial: How To Implement ISO 27001 Clause 8.3 Information Security Risk Treatment
ISO 27001 Clause 8.3 FAQ
The ISO 27001 standard requires an organisation to perform risk treatment for identified risks and record evidence of the risk treatment.
You can download ISO 27001 Clause 8.3 Information Security Risk Treatment templates in the ISO 27001 Toolkit.
An example of ISO 27001 Clause 8.3 Information Security Risk Treatment can be found in the ISO 27001 Toolkit.
Yes. A complete guide to the ISO 27001 Clause 8.3 Information Security Risk Treatment risk register can be found here.
A guide to the ISO 27001 risk management policy used by ISO 27001 Clause 8.3 is located here.
There are several ways to keep and how evidence of a risk assessment:
1. Hold an annual risk review meeting and minute the results
2. Maintain and use a risk register
3. Follow the structure agenda of the management review team meeting which covers risk assessment
4. Include risk assessment as part of your operational processes
At any point that the risk identified is unacceptable and needs to be addressed
Read the complete guide to ISO 27001 risk assessment here.
Further Reading
For more on planning for risk assessment be sure to read: ISO 27001 Clause 6.12 Information security risk assessment Guide
For more on planning for risk treatment be sure to read: ISO 27001 Clause 6.1.3 Information Security Risk Treatment Guide