Information security risk treatment
6.1.3
-
Last updated
Mandatory
Catalog reference
Define a risk treatment process that selects appropriate options and controls, compares them against Annex A, produces a Statement of Applicability, formulates a treatment plan, and obtains risk owner approval and acceptance of residual risk.
Narrative — how we satisfy this requirement
Each Treating Risk has a treatment action with an Owner and a due date, and the ISMS Manager follows the actions in the monthly ISMS meeting.
Review
On trackNext review is 10/27/2027 — no urgency right now.
- Review cadence
- Every 365 days
- Last reviewed
- Next review due