Control 6.1.3Information security risk treatment

Define and apply a risk treatment process: select appropriate options taking account of the assessment results, determine the controls necessary to implement them, compare those controls against Annex A to verify that no necessary control has been omitted, produce a Statement of Applicability, formulate a risk treatment plan, and obtain risk owners’ approval of the plan and acceptance of residual risks.

The direction of travel matters and is routinely reversed. Controls are determined by the treatment the risk requires; Annex A is then used as a check against omission, not as the source. An ISMS built by working down Annex A and justifying each control produces a Statement of Applicability that describes a control set rather than a risk treatment, and it shows — the risks and the controls do not line up.

The Statement of Applicability must give the justification for inclusions, whether the controls are implemented, and the justification for any exclusions. Residual risk acceptance is the risk owner’s, in writing.

How to put this in place

This is where risks become decisions about controls. Controls must come from the assessment, and the Statement of Applicability must explain every inclusion and exclusion.

Choose a treatment for each risk: reduce, accept, avoid or share.
Select the controls needed, then compare them with Annex A to catch anything missed.
Complete the Statement of Applicability for all 93 controls with reasons.
Write the treatment plan with owners and dates.
Obtain risk owner approval of the plan and acceptance of residual risk.

Evidence an auditor usually looks for: the treatment plan, the Statement of Applicability, the comparison with Annex A, and risk owner acceptance of residual risk.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 3 (Select and document controls) of the implementation plan, which sets out the work and the gate that closes the phase.
Annex A Control Implementation LibraryExcel
Explains each Annex A control and whether it usually applies, so the controls your risk treatment chooses can be compared with the full list.
Statement of Applicability TemplateExcel
A template for the Statement of Applicability: one row per Annex A control, recording whether it applies, why, and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, items MD-04 to MD-06: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
ISMS Gap & Remediation TrackerExcel
The Gap Register can track the actions in a risk treatment plan with an owner, a date and a status.
Management Review Meeting PackWord
The decisions to record include whether the residual risks put forward by risk owners are accepted or sent back for treatment.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.