Information security risk treatment (operational)
8.3
-
Last updated
Mandatory
Catalog reference
Implement the risk treatment plan and retain documented information on the results of the treatment.
Narrative — how we satisfy this requirement
Treatment actions are carried out as Tasks with an Owner, and what they achieve is read back at the next Risk review.
Review
On trackNext review is 10/27/2027 — no urgency right now.
- Review cadence
- Every 365 days
- Last reviewed
- Next review due