A risk assessment identifies and rates your risks. A risk treatment plan decides what to do about each one: treat, transfer, avoid or accept. Clause 8.3 requires you to carry out the plan and keep records of the results. A risk register is the working list that many teams use to hold all three.
The three artifacts
| Artifact | Clause | Question it answers |
|---|---|---|
| Risk assessment | 6.1.2 and 8.2 | What are our risks and how serious are they? |
| Risk treatment plan | 6.1.3 | What will we do about each risk, who owns it, by when? |
| Treatment results | 8.3 | Did we do it, and what is left over? |
The standard asks for documented information about the assessment and about the results of treatment. It does not, as far as the sources we read show, require a document called a "risk register". Treat the register as a practical tool, not a named requirement, and ask your certification body what it expects to see.
What goes in the treatment plan
Two published guides describe it in similar terms. For each risk above your acceptance level you choose an option, pick the controls needed (often from Annex A) and check them against Annex A to produce the Statement of Applicability. The risk owner then approves the residual risk, which is what remains after treatment.
Add an owner and a date to every line. Plans without owners tend to drift.
The four options in plain words
- Treat. Add or improve controls to cut likelihood or impact.
- Transfer. Share the treatment, for example through insurance or a supplier. You cannot hand off accountability.
- Avoid. Stop the activity that creates the risk.
- Accept. Live with it, with a recorded decision.
Who can accept a risk
A frequent audit finding described in one guide is an unauthorised acceptance: a high risk marked "accept" by someone without authority, often because there was no budget. Acceptance belongs to the risk owner, who is the person with authority over the business impact, and it needs a record. A separate short post covers who can accept a risk.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how selected controls connect back to requirements.
Keeping the three consistent
- Give every risk an ID that appears in the plan and in the Statement of Applicability.
- Link each treatment action to a ticket or change record, so clause 8.3 evidence exists.
- Re-run the assessment at planned intervals and after big changes.
- Review the residual risk list at each management review.
Quick check
Can one spreadsheet hold all three?
Yes, if the columns separate assessment, plan and results clearly. Many small teams do this. Check that it meets your certification body's expectations.
Is the Statement of Applicability part of risk treatment?
It is produced during risk treatment planning under clause 6.1.3 and lists which Annex A controls apply and why.
Safeguard's vulnerability and dependency scanning can feed technical risk findings into your assessment, and its evidence automation can keep records of fixes. Certification itself comes from an accredited body.
Sources
- ISO 27001 clause 6.1.3, risk treatment plan and Statement of Applicability
- ISO 27001 clause 8.3, risk treatment
- ISO 27001 clause 6, planning
Last reviewed: 19 October 2026.
