What is an ISO 27001 risk treatment plan?
An ISO 27001 risk treatment plan should be developed following a company’s completion of its risk assessment, documenting its actions to address each risk identified during the assessment process. When determining how to respond to an identified risk, companies typically select from options: acceptance, mitigation, transfer, and avoidance.
A risk treatment plan will frequently contain the following elements:
- Summary of each of the identified risks
- Responses designed for each risk
- Assigned owner to each identified risk, who is accountable for their respective risks
- Designated risk mitigation activity owners, responsible for performing the tasks required to address the identified risks
- Target completion date for risk treatment activities
A company will subsequently determine which controls to implement to help address identified risks. Annex A of ISO 27001 provides an ideal starting point; it contains 114 controls, divided into 14 sections, each tailored to a specific aspect of information security. When selecting controls from Annex A, a company will want to begin filling out the Statement of Applicability (SoA), a list of all of the Annex A controls, including the justification for each control's inclusion or exclusion as part of the organization’s Information Security Management System (ISMS) implementation.
{{cta_withimage2="/cta-modules"}}
Join John Hammond—cybersecurity researcher, practitioner, and content creator with nearly two million YouTube subscribers—and Vanta’s Matt Cooper, Vanta’s Director of GRC, for a fireside chat on AI, security maturity, and the top security risks in 2025.
Join John Hammond—cybersecurity researcher, practitioner, and content creator with nearly two million YouTube subscribers—and Vanta’s Matt Cooper, Vanta’s Director of GRC, for a fireside chat on AI, security maturity, and the top security risks in 2025.
Join Vanta’s 45-minute live demo to see how our platform automates up to 90% of the work for achieving ISO 27001 and SOC 2 compliance, helping you streamline security and move towards continuous compliance.
Watch a fireside chat with Christina Cacioppo, CEO and Co-founder of Vanta, and Eric Ries, author of The Lean Startup, as they share insights on navigating the modern startup journey. Discover how founders today can adapt to AI-driven innovation and utilize startup principles to find success in today’s dynamic landscape.
Join Vanta’s live product demo to discover how automation, continuous monitoring, and centralized workflows can streamline your GRC program, enhance control visibility, and improve vendor and buyer security management—all within a single platform.
.svg)
.svg)
