Why Is Risk Treatment Important in ISO 27001?

Risk assessment lets you know what can go wrong and the significance of the risk. Risk treatment then asks: what will you do about it?

A process-oriented risk treatment process under ISO 27001 will help organizations:

• Prioritize risks
• Assign accountability
• Select appropriate controls
• Track remediation actions
• Document security decisions
• Evaluate residual risks
• Showcase a systematic approach to ISO 27001 risk management

ISO/IEC 27001 integrates risk assessment and treatment in the ISMS planning process. It also requires organizations to compare the controls they determine to be necessary with the controls in Annex A and produce a Statement of Applicability (SoA). 

 How to Create an ISO 27001 Risk Treatment Plan

The following ISO 27001 risk treatment process can be used as a practical starting point.

1.Information Security Risk Identification 

Begin with your assets, systems, processes, people, and outside dependencies.

Identify any threats or vulnerabilities that may impact confidentiality, integrity, or availability.

Examples include:

• Unauthorized access to customer data
• Phishing and compromised credentials
• Cloud misconfiguration
• Ransomware affecting production systems
• Loss of a critical supplier
• Accidental deletion of important information

Document the cause, event, affected asset or process, and potential consequence for each risk.

2. Analyze and Evaluate the Risks

Identify the probability and possible effect of the risk according to the method determined by your company.

One way is by assessing the level as low, medium, and high. More sophisticated firms may use numerical ratings or some other criterion.

Consistency is important here. Risks that are similar must have the same criteria.

Afterwards, compare each assessment to your risk acceptance standards. This will help you identify the risks that need treatment and the ones that can be accepted.

3. Select a Risk Treatment Option

Treatments commonly available are:

Avoid the risk: Avoid taking the risk by altering or stopping the activity that presents the risk.

Mitigate the risk: Undertake controls that will decrease the probability and/or consequence of the risk.

Transfer the risk: Transfer part of the risk to a third party through contracts or insurance.

Accept the risk: Accept the risk when it lies within the criteria for acceptance.

The choice of which option to follow would depend on the nature of the risk, the needs of the business, the resources, and the level of risk exposure accepted. Risk treatment affects the risk in many ways.

4. Determine the Necessary Controls

Identify the necessary controls required to implement the chosen response.

This may include, for instance, where the threat is unauthorized access to the production environment, authentication, access review, privileged access management, logging, and monitoring.

Annex A provides a reference set of information security controls. It should not simply be treated as a checklist where every control is automatically required. ISO/IEC 27001 guidance explains that organizations compare controls determined through risk treatment with Annex A and verify that necessary controls have not been omitted.

Organizations can also use controls outside Annex A when their risk treatment requires them. Necessary controls should be reflected in the Statement of Applicability.

5. Create the Statement of Applicability

The Statement of Applicability (SoA) documents the necessary controls, the justification for their inclusion, their implementation status, and the justification for excluding any Annex A controls. 

The SoA and risk treatment plan have different purposes. The treatment plan focuses on actions for addressing risks, while the SoA provides a structured view of necessary controls and their status or justification.

6. Assign Risk Owners and Actions

Every treatment action should have clear ownership.

Record:

• Risk description and rating
• Treatment decision
• Required control or action
• Risk owner
• Target date
• Status
• Expected residual risk
• Required approval or acceptance

Clear ownership prevents the risk register from becoming a document that is updated but not acted upon.

7. Evaluate Residual Risk

After controls are implemented, reassess the risk.

The remaining exposure is called residual risk. Compare it with the organization’s risk acceptance criteria.

If the residual risk is acceptable, the appropriate risk owner can approve or accept it according to the organization’s process. If it remains unacceptable, additional treatment may be necessary.