Key takeaways
- Implement the risk treatment plan and keep results.
- Treatment plans only reduce risk if they are executed.
- Start here: implement the risk treatment plan.
Purpose
Implement the risk treatment plan and keep results.
Requirement
Requirement summaryThe organization shall retain documented information of the results of the information security risk treatment.
Why it matters
Treatment plans only reduce risk if they are executed.
How to implement
- Implement the risk treatment plan.
- Track actions to completion.
- Keep records of results.
- Update the plan as actions complete or risks change.
What evidence you need to provide
Here is what you will typically need to provide for Clause 8.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your risk treatment plan with its current status.
Records and examples to show
- Proof treatment actions were completed.
- Records of risk owners accepting the remaining risk after treatment.
Things you should be able to show or explain
- Be able to explain how completed treatments are checked.
How much to show: A handful of completed actions.
Common mistakes
- Actions marked done with no proof.
- Remaining risk never accepted.
- Treatment plan out of date.
- Actions overdue with no follow-up.
- Tip: Re-run your risk assessment whenever something big changes, not just yearly.
Policies & documents to have
- Risk assessment and treatment methodology
- Statement of Applicability (SoA)
FAQ
Can we exclude clause 8.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Treatment actions completed or tracked.