Key takeaways
- Define a repeatable risk assessment method, assess information security risks, choose treatment options and controls, compare against Annex A, and produce a Statement of Applicability and risk treatment plan.
- Treatment decides what you will do about each risk and leads to the Statement of Applicability.
- Start here: choose treatment options: modify, avoid, share or accept.
Purpose
Define a repeatable risk assessment method, assess information security risks, choose treatment options and controls, compare against Annex A, and produce a Statement of Applicability and risk treatment plan.
Requirement
Requirement summaryThe organization shall define and apply an information security risk treatment process to: a) select appropriate information security risk treatment options, taking account of the risk assessment results; b) determine all controls that are necessary to implement the information security risk treatment option(s) chosen; NOTE 1 Organizations can design controls as required, or identify them from any source. c) compare the controls determined in 6.1.3 b) above with those in Annex A and verify that no necessary controls have been omitted; NOTE 2 Annex A contains a list of possible information security controls. Users of this document are directed to Annex A to ensure that no necessary information security controls are overlooked. NOTE 3 The information security controls listed in Annex A are not exhaustive and additional information security controls can be included if needed. d) produce a Statement of Applicability that contains: — the necessary controls (see 6.1.3 b) and c)); — justification for their inclusion; — whether the necessary controls are implemented or not; and — the justification for excluding any of the Annex A controls. e) formulate an information security risk treatment plan; and f) obtain risk owners’ approval of the information security risk treatment plan and acceptance of the residual information security risks. The organization shall retain documented information about the information security risk treatment process.
Why it matters
Treatment decides what you will do about each risk and leads to the Statement of Applicability.
How to implement
- Choose treatment options: modify, avoid, share or accept.
- Select controls and compare them to Annex A to check nothing is missed.
- Produce a Statement of Applicability with justifications.
- Write a risk treatment plan and get risk owner approval and acceptance of residual risk.
What evidence you need to provide
Here is what you will typically need to provide for Clause 6.1.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your risk treatment plan: what you will do about each risk, who owns it and by when.
Records and examples to show
- Your Statement of Applicability (SoA): the list of all 93 Annex A controls showing which you use and why, and why any are left out.
- Proof risk owners approved the plan and accepted the remaining risk.
- Progress updates on treatment actions.
Things you should be able to show or explain
- Be able to explain how a risk led to the controls you chose.
How much to show: A handful of risks traced to controls.
Common mistakes
- Controls chosen with no link to risks.
- Treatment overdue with no update.
- SoA exclusions with no justification.
- No formal acceptance of residual risk.
- Tip: Your Statement of Applicability is the document auditors ask about most. Make it tidy!
Policies & documents to have
- Risk assessment and treatment methodology
- Statement of Applicability (SoA)
FAQ
Can we exclude clause 6.1.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A consistent method, risk owners, sensible results, and an SoA that justifies inclusions/exclusions.