ISO 27001 risk treatment plan: what to include and how to run it
An ISO 27001 risk treatment plan records what will be done about each risk that is not accepted as it stands: the chosen option (modify, share, avoid or retain), the controls or actions, the owner, the agreed date, progress and the expected residual risk. ISO/IEC 27001:2022 requires it in clause 6.1.3, requires risk owners to approve the plan and accept the residual risk, and clause 8.3 requires the plan to be implemented with evidence of the results kept.
What ISO/IEC 27001:2022 requires for risk treatment
Treatment starts where the risk assessment (clause 6.1.2) ends. In short, clause 6.1.3 asks the organization to:
- Choose an appropriate treatment option for each risk based on the assessment results.
- Determine the controls needed to implement that option, from any source.
- Compare those controls with Annex A so that no necessary control is missed.
- Produce the Statement of Applicability with included and excluded controls and the justification.
- Formulate the risk treatment plan.
- Obtain the risk owners' approval of the plan and their acceptance of the residual risk.
Clause 8.3 requires the plan to be implemented and documented information on the results to be retained. In other words, an auditor does not only check that the plan exists: they check that actions progress, that there is evidence, and that someone with authority signed off the risk that remains.
Columns of a risk treatment plan in Excel
The standard does not prescribe a format. These are the columns of the NexoDocs toolkit's treatment plan (ISMS-RSK-03), designed so every row can be traced from the risk register to the Statement of Applicability:
| Column | What it is for |
|---|---|
| Risk ID and risk | The same ID as the risk register: links assessment, treatment and SoA |
| Current level | The level rated in the assessment, before treatment |
| Option | Modify (mitigate), share (transfer), avoid or retain (accept) |
| Action or control to implement | What will actually be done, in one verifiable sentence |
| Annex A controls | The related controls (for example A.5.17 and A.8.5 for credentials) |
| Owner and agreed date | Who carries it out and by when |
| Status and % progress | Planned, in progress, done; supports monthly follow-up |
| Residual impact and likelihood | The estimate after the action is applied |
| Residual level and category | Calculated automatically with the same criteria as the assessment |
| Residual risk approved by and date | Evidence that the risk owner accepted it |
| Budget or resources | What is needed to meet the date |
| Expected result or effectiveness indicator | How you will know it worked (for example 100% of accounts with MFA) |
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the full toolkitThe four risk treatment options
| Option | When to use it | Example |
|---|---|---|
| Modify (mitigate) | The risk exceeds the acceptance criteria and reasonable controls exist | Enforce MFA to reduce credential theft |
| Share (transfer) | A third party can absorb part of the impact | Cyber insurance or a contract with the cloud provider |
| Avoid | The activity is not worth the risk | Stop storing card data on your own servers |
| Retain (accept) | The level is within the criteria or treating it is disproportionate | Low risk accepted by its owner, dated and signed |
Sharing a risk does not remove accountability: the organization still answers to customers and regulators, and must manage the third party. Retaining is not "doing nothing" either: it is a documented decision by the risk owner, reviewed at the next assessment.
How to rate residual risk
Residual risk is what remains after treatment. Rate it on the same scale as the assessment (for example impact times likelihood from 1 to 4) and compare it with the same acceptance criteria. If the residual level is still above the criteria, add actions or have the owner accept it explicitly, with a justification.
Example from the toolkit: theft of developer credentials starts at level 12 (high). With MFA enforced on the code repository and the cloud console, residual impact is rated 4 and likelihood 1, residual level 4 (low), and the development lead approves it with a date.
How it relates to the Statement of Applicability
They are two sides of the same work. The plan says what will be done about each risk; the Statement of Applicability says which Annex A controls are included or excluded, why, and whether they are implemented. Every control in the plan should appear as included in the SoA, and every included control should be justified by a risk, a legal or contractual requirement, or an organizational decision.
Common mistakes auditors find
- Vague actions such as "improve security" with no specific control or date.
- Generic owners ("IT") instead of a role or a person.
- Residual risk not rated, or not signed off by the risk owner.
- Overdue dates with no new date or explanation.
- Controls in the plan that are missing from the SoA, or the other way round.
- A plan that is not updated after a new risk assessment.
Template: the NexoDocs risk treatment plan
The treatment plan in the NexoDocs ISO 27001 toolkit is a macro-free Excel workbook with the columns in this guide, drop-down lists for option and status, automatic residual level and category based on the approved criteria, and a fully worked example for a fictitious company. It connects to the toolkit's risk methodology, risk register and Statement of Applicability. You can try the free risk register sample first.
Next step
Try it free or go straight to the complete solution.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the full toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
Is a risk treatment plan mandatory in ISO 27001?
Yes. Clause 6.1.3 requires it to be formulated and retained as documented information, and clause 8.3 requires it to be implemented with the results retained.
Who approves the risk treatment plan?
The risk owners. They approve the plan and accept the residual risk; record their name or role and the date on each row.
Can high risks be accepted?
The standard allows it if the risk owner makes an informed, documented decision, but an auditor will expect a clear justification and periodic review.
How often should the plan be updated?
Whenever the risk assessment changes and as part of normal ISMS follow-up; in practice, a monthly progress check and a full review at least once a year.
Does a template guarantee passing the audit?
No. Certification depends on how the ISMS is implemented and on the audit by a certification body; a good template organizes the work and leaves clear evidence.
Related guides
ISO 27001 risk assessment template: what it must include and how to use it
What ISO/IEC 27001:2022 requires for risk assessment, the columns an ISMS risk register needs, and how to calculate risk levels. Includes a free Excel sample.
Read the guide →ISO 27001 Statement of Applicability (SoA): example, template and how to write it
What the ISO/IEC 27001:2022 Statement of Applicability must contain, a worked example, 2013 vs 2022 changes, how auditors review it and an Excel template.
Read the guide →ISO 27001:2022 mandatory documents and records: checklist by clause
Checklist of the documents and records ISO/IEC 27001:2022 requires, clause by clause, which Annex A documents apply and common audit gaps.
Read the guide →Updated: 2026-10-29