Control 8.3Information security risk treatment
Implement the information security risk treatment plan, and retain documented information of the results.
Two lines, and they are where most ISMS failures actually surface. Clause 6.1.3 requires a plan approved by risk owners; this requires the plan to be carried out.
An auditor reads the treatment plan, takes the actions with past due dates, and asks what happened. The answers separate a functioning system from a documented one: actions completed and evidenced; actions rescheduled with the risk owner’s agreement and the residual risk re-accepted; or actions simply overdue, which is a nonconformity under clause 10.2 and, more importantly, means the organisation is carrying risk it decided not to carry.
Retaining results is not the same as retaining the plan. What is needed is evidence that the treatment was implemented and that it did what the treatment decision expected of it — which is where this clause hands over to monitoring in 9.1.
How to put this in place
The treatment plan only helps if it is carried out and checked. Many gaps arise because actions are marked done without evidence.
- Carry out the treatment plan in the agreed order.
- Record evidence for each completed action.
- Reassess the residual risk after treatment.
- Obtain risk owner acceptance of the remainder.
- Update the plan and the Statement of Applicability.
Evidence an auditor usually looks for: risk register updates that show completed treatment with evidence and accepted residual risk.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 4 (Implement and operate) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-12: the typical form, what auditors accept instead and the gaps they reliably find.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.