Risk treatment is the stage of risk management in which an organization decides what to do with each assessed risk: mitigate it with controls, avoid it by stopping the activity, transfer it, for example through cyber insurance, or accept it. In ISO 27001 these decisions are documented in a risk treatment plan. Risk appetite sets the acceptable level; treatment is the decision about each risk.
Go deeper on the TecnetBlog: Cybersecurity Risk Management
risk treatment plan, risk treatment options, risk mitigation, risk response, ISO 27001 risk treatment
Related terms
ISO 42001
ISO/IEC 42001:2023 is the international standard that sets the requirements for an artificial intelligence (AI) management system: policies, risk and impact assessment, controls and continual improvement for developing, providing or using AI responsibly. It is certifiable and follows the same high-level structure as ISO 27001, so it can be integrated into an existing security management system.
Internal and external audit (ISO 27001)
An ISO 27001 internal audit is a review an organization performs on its own ISMS (information security management system), using staff or a third party independent of the audited area, to verify it conforms to the standard, as clause 9.2 requires. An external audit is performed by a certification body to grant or maintain certification. Both assess the management system, not only technical controls.
Cybersecurity maturity model
A cybersecurity maturity model is a scale that measures how established, documented and continuously improved an organization's security practices are, usually in levels that range from informal processes to measured and optimized ones. A maturity assessment shows where the company stands, compares it with a reference framework and helps prioritize the next step.
Statement of Applicability (SoA)
A Statement of Applicability (SoA) is the mandatory ISO/IEC 27001 document that lists the Annex A controls, states which ones the organization applies and justifies the inclusion or exclusion of each. It is one of the first documents a certification auditor reviews, because it links the risk assessment to the controls actually implemented.
Virtual CISO (vCISO)
A virtual CISO (vCISO) is a service in which an outside specialist takes on the duties of a chief information security officer (CISO) on an hourly or subscription basis: strategy, policies, risk management and reporting to leadership. It is common in midsize companies that need that leadership for an audit or a customer requirement but cannot justify a full-time hire.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.