ISO/IEC 27005 FAQ Treatment Options

ISO/IEC 27005 uses four practical treatment choices: accept the risk, avoid the risk, modify the risk by changing controls or plans, or share the risk with another party. The right choice depends on whether the risk is within tolerance, whether the activity can be changed or stopped, whether controls can reduce the risk to an acceptable level, and whether transfer or sharing is available through contracts, insurance, or other arrangements.

Start with one decision record: scope, required inputs, owner, evidence location, and review condition. Then route the result to treatment or acceptance gates. If the risk is already within tolerance, acceptance may be appropriate. If the activity should not continue, avoid it. If the risk can be reduced, modify it. If another party can carry part of the exposure, share it.

The evidence should show the process operating. For this artifact, the strongest record usually includes risk criteria, scenarios, likelihood and impact rationale, treatment decisions, residual-risk approvals, and review records.

Avoid evidence that only repeats a requirement. A reviewer should be able to see the actual owner, date, system, supplier, AI system, service, incident, risk, or control sample behind the answer.

The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions.

For high-impact changes, approval should include the teams affected by the evidence: security, privacy, resilience, supplier management, AI governance, legal, risk, or business service owners as relevant.

Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, AI system, personal data flow, incident process, or customer commitment changes.

A stale record is worse than a short record. If the facts change, update the evidence and mark what changed so the next reviewer can trust the page.