Skip to content

Risk Treatment Plan

What is Risk Treatment Plan?

A documented plan specifying the actions, resources, timelines, and responsibilities for implementing risk treatment measures.

Risk Management

Frameworks that govern risk treatment plan

NIST Cybersecurity Framework 2.0View framework →ISO 27001:2022View framework →

What the standards actually require on risk treatment plan

Requirements naming risk treatment plan across 6 standards, quoted from the control text.

ISO 27005:20222 controls

Requirement defined in ISO 27005:2022, clause 8.6.1 (Formulation of the risk treatment plan). See licensed source for normative text.

iso-27005-2022::8.6.1 · Formulation of the risk treatment plan →
ISO 31000:20181 control

Requirement defined in ISO 31000:2018, clause 6.5.3 (Preparing and implementing risk treatment plans). See licensed source for normative text.

iso-31000-2018::6.5.3 · Preparing and implementing risk treatment plans →
ISO/IEC 23894:20231 control

Requirement defined in ISO/IEC 23894:2023, clause 6.5.3 (Preparing and implementing risk treatment plans). See licensed source for normative text.

iso-iec-23894-2023::6.5.3 · Preparing and implementing risk treatment plans →
ISO/IEC 27003:20172 controls

Implement the information security risk treatment plan and retain evidence of results.

27003-8.3 · Risk Treatment Implementation →
ISO 27001:20221 control

The management review shall consider the status of actions from previous reviews, changes in external and internal issues relevant to the management system, changes in the needs and expectations of interested parties, feedback on information security performan...

iso-27001-2022::9.3.2 · Management review inputs →
ISO 27701:20191 control

The requirement of ISO/IEC 27001 to implement the risk treatment plan applies to the PIMS, so the privacy controls chosen during treatment must actually be implemented and their implementation evidenced.

iso-27701-2019::5.6.3 · Information security risk treatment →

Questions people ask about risk treatment plan

What is Risk Treatment Plan?
A documented plan specifying the actions, resources, timelines, and responsibilities for implementing risk treatment measures.
Why is Risk Treatment Plan important for compliance?
Risk Treatment Plan is a key concept in Risk Management. Understanding risk treatment plan helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Risk Treatment Plan?
Risk Treatment Plan appears in the requirement text of ISO 27005:2022, ISO 31000:2018, ISO/IEC 23894:2023, ISO/IEC 27003:2017, ISO 27001:2022. Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Risk Treatment Plan?
Explore our compliance framework pages to see how risk treatment plan applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Risk Treatment Plan applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.