We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQ item index

Search every question across sub-FAQs

Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.

Indexed coverage
32of32items
Across 8 modules • Updated Jul 24, 2026
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Back to sub-FAQs
ISO/IEC 27005 Treatment Options

Who owns and approves treatment options decisions?

The risk owner approves the treatment plan and decides whether residual risk is acceptable. Treatment owners implement assigned actions and control owners operate controls. Analysts can estimate expected risk reduction, but they do not replace the risk owner's approval.

  • Assign each action, resource, target date, and effectiveness measure to a named owner.
  • Escalate when residual risk exceeds the owner's delegated acceptance level or treatment needs authority across organizational boundaries.
  • Obtain approval again when material changes alter the plan, expected residual risk, cost, or completion date.
Citations
ISO/IEC 27005:2022 standard page

ISO/IEC 27005:2022 Clause 8.6 and Clause 10.3 distinguish risk-owner approval and acceptance from implementation and communication responsibilities.

Jump to answerOpen module
ISO/IEC 27005 Treatment Options

When should treatment options be reviewed?

Review treatment at planned milestones and when implementation, effectiveness, context, threats, vulnerabilities, controls, criteria, or the scenario changes. If treatment is ineffective or the residual risk remains unacceptable, revise the plan or repeat the assessment and treatment process.

  • Measure whether controls operate and modify likelihood or consequence as expected.
  • Trigger review after delays, failed controls, audit findings, incidents, user circumvention, new threats or vulnerabilities, or changed requirements.
  • Record the new residual risk and obtain a new acceptance or further-treatment decision.
Citations
ISO/IEC 27005:2022 standard page

ISO/IEC 27005:2022 Clauses 5.1, 9.2, 10.7, and 10.8 describe iterative treatment, implementation, effectiveness review, plan revision, and ongoing monitoring.

Jump to answerOpen module
Page 3 of 3
Previous123Next