Free resource · ISO/IEC 27001:2022
ISO 27001 Risk Treatment Plan Template
Clause 6.1.3 requires a risk treatment plan: for every risk above your threshold, a decision, the controls that implement it, an owner and a date. Use the columns below or download the CSV with two worked example rows.
Columns every plan needs
- Risk ID and description (from your risk register)
- Risk owner (a person who can accept the risk)
- Inherent risk score: likelihood × impact before treatment
- Treatment option: treat, tolerate, transfer or terminate
- Selected Annex A controls (for example A.5.15 Access control, A.8.5 Secure authentication)
- Actions: what will be done, by whom and by when
- Residual risk score after treatment
- Approval date and who accepted the residual risk
The four treatment options
- Treat (modify): apply controls to reduce likelihood or impact
- Tolerate (retain): accept the risk when it is within your appetite, with a recorded justification
- Transfer (share): move part of the risk with insurance or a contract, and still control what stays with you
- Terminate (avoid): stop the activity or remove the asset that creates the risk
Approval and acceptance
- Risk owners have approved the treatment plan
- Risk owners have accepted residual risk in writing
- Residual risk is recorded and below the agreed acceptance threshold
- Every control chosen appears in the Statement of Applicability, and every SoA inclusion traces back to a risk or requirement
What auditors check
- No risk above threshold is left without a decision
- Treatments are implemented, not only planned, with dated evidence
- Residual risk scores follow from the controls applied
- The plan is reviewed after incidents, audits and significant change
Based on ISO/IEC 27001:2022 clause 6.1.3 and Annex A. The CSV includes two illustrative rows; replace them with your own risks. See iso.org for the authoritative standard.
Risk treatment plan FAQ
- What is a risk treatment plan in ISO 27001?
- It is the documented plan from clause 6.1.3 that records, for each assessed risk, the treatment option chosen, the Annex A or other controls that implement it, who owns the actions and the residual risk that remains.
- What is the difference between the risk register and the risk treatment plan?
- The risk register lists risks and their scores. The treatment plan says what you will do about each one. Many teams keep both in one spreadsheet, but the standard treats them as separate documented outputs.
- Can we accept a risk instead of treating it?
- Yes. Tolerating a risk is a valid treatment option if it is within your defined acceptance criteria and the risk owner approves it. The decision and the justification must be recorded.
- How does the plan connect to the Statement of Applicability?
- The controls you choose in the plan feed the SoA. Each control is marked applicable with the risk it treats as justification, and controls you exclude need a reason.
Track treatments, not spreadsheets
CATAAM links each risk to the controls that treat it and collects the evidence automatically, so residual risk is something you can show.