After reading, you can choose a treatment option for each risk and turn it into actions someone will really finish.
Definition
Four options cover most situations: reduce the risk with controls, avoid it by stopping the activity, share it through insurance or a contract, or retain it knowingly. ISO 31000 sets out a more detailed list of the same choices.
Clause 6.1.3 of ISO/IEC 27001 requires a formulated plan, and it asks the risk owners both to approve it and to accept the residual risk.
Why it matters
An assessment on its own changes nothing. The plan is where a score becomes a budget line, a name and a date.
It also protects people. When a risk stays open and something later goes wrong, the plan shows it was a decision made by someone entitled to make it.
How it works
Work down from the risks above your acceptance level, highest first, and choose an option for each. Cost belongs in this conversation: spending €50,000 against a €10,000 exposure rarely makes sense.
Break the choice into actions small enough to have one owner and one date, and estimate the score you expect once they are complete.
The risk owner then approves the plan and accepts what will remain. Follow it through to the end, and check that each new control works before calling the action closed.
A worked case
Risk: a stolen password opens access to customer records, score 15. The option is to reduce it.
Two actions follow. The IT manager puts multi-factor authentication on all administrator accounts by 30 June, for €2,000. Department heads review access rights each quarter, starting 15 July. The expected score is 6, and the managing director signs for that residual risk on 3 March.
Good practices
- Show the cost of each action, so that it can compete fairly for budget.
- Report overdue actions to management at every review. Plans tend to slip when nobody senior sees the delay.
- Test the control before closing the action, and keep what the test showed.
- Write down who accepted the residual risk and on what date.
Common mistakes
- Writing “improve security” as an action. Nobody can tell when it is finished, so it never is.
- Treating insurance as if the risk had gone away. The policy may pay, but the outage still happens and customers still leave.
- Having a risk accepted by someone without the authority to accept it. When the loss arrives, that acceptance will not stand up.
- Keeping the plan in a separate file from the register. The two drift apart within months.
Questions
- What are the four risk treatment options?
- Reduce, avoid, share and retain. The names vary between standards, and ISO 31000 lists more detailed variants.
- Who approves the risk treatment plan?
- Under ISO/IEC 27001, the risk owners approve it and accept the residual risk.
- Must every risk be reduced?
- No. A risk within your acceptance criteria can stay as it is, and so can one whose fix would cost far more than the loss it prevents, if the owner accepts it knowingly.
- How does the plan relate to the Statement of Applicability?
- The controls chosen in the plan feed the Statement of Applicability, which gives a position on every Annex A control.
- How often is the plan updated?
- Whenever an action changes status, and at least at each risk review.