Information security risk treatment
6.1.3
-
Last updated
Mandatory
Catalog reference
Define a risk treatment process that selects appropriate options and controls, compares them against Annex A, produces a Statement of Applicability, formulates a treatment plan, and obtains risk owner approval and acceptance of residual risk.
Narrative — how we satisfy this requirement
Each Treating Risk has a treatment action with an Owner and a due date, and the ISMS Manager follows the actions in the monthly ISMS meeting.
None due within 31 days.