thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Risk Treatment Plan

Document describing how identified risks will be treated, by whom, with what resources, and by when.

Definition

Required by ISO/IEC 27001 Clause 6.1.3, the plan records chosen treatment options, controls, owners, timelines, and approval of residual risk by risk owners. It is tied to the SoA. Progress is reviewed as part of performance evaluation.

Example

The plan assigns the IT manager to implement encrypted backups by Q2 to treat data loss risk.

Exam tip

Risk owners must approve the risk treatment plan and accept residual risk under ISO 27001.

Related terms