Practical toolGlobalISO/IEC 27005

ISO/IEC 27005 Risk Treatment Plan Template

For every prioritized risk, choose avoidance, modification, retention, sharing, or a justified combination. Then record the necessary controls, owners, actions, resources, timing, measures, expected residual risk, and approval.

For an ISO/IEC 27001:2022 ISMS, compare necessary controls with Annex A as a completeness check and keep the treatment plan consistent with the Statement of Applicability.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

ISO/IEC 27005:2022 gives guidance for managing information security risk; it does not prescribe this template. For an ISMS based on ISO/IEC 27001:2022, clause 6.1.3 requires the organization to formulate an information security and obtain risk-owner approval of the plan and acceptance of the residual information security risks. Start with the prioritized assessment results. Select a treatment option for each risk, determine every control needed to carry it out, compare those controls with ISO/IEC 27001:2022 , and record the work as an approved risk treatment plan. Include accountable and responsible people, actions, resources, dependencies, milestones, performance indicators, monitoring, implementation status, expected , and the later effectiveness check. Use Annex A to check for omissions; select controls because they are necessary for the risk.

Section 1

What should an ISO/IEC 27005 risk treatment plan contain?

The plan should connect every risk that needs treatment to a chosen option and the work required to meet the organization's acceptance criteria. ISO/IEC 27005:2022 recognizes avoidance, modification, retention by informed choice, and sharing. Different risks can use different plans, but together the plans should cover every prioritized risk selected for treatment. The standard does not set one required form: an organization can use several plans organized by location, asset, event, or another workable grouping.

ISO/IEC 27005 distinguishes two useful views. The project view schedules implementation and becomes a historical record after delivery. The design view explains how preventive, detective, and corrective controls interact with the environment and with each other, so it remains useful for monitoring and later reassessment.

Option and rationale: state why the option was chosen, the expected benefit, constraints, affected parties, and the consequence or likelihood it is intended to change.
Necessary controls: choose controls from any suitable source or design custom controls, then check what each control does to the specific risk.
Target state: state the expected residual consequence, likelihood, and level, the criteria it is expected to meet, and any temporary exposure before full effectiveness.

Sources for this answer

ISO/IEC 27005:2022 standard page

ISO/IEC 27005:2022 clauses 8.1-8.6 cover treatment options, necessary controls, Annex A comparison, the Statement of Applicability, plan content, owner approval, and residual risk.

ISO/IEC 27001:2022 standard page

ISO/IEC 27001:2022 clause 6.1.3 requires selected treatment options, necessary controls, Annex A comparison, a Statement of Applicability, a treatment plan, owner approval, and residual-risk acceptance.

Section 2

Which records make the treatment plan reviewable?

Identify the risk, assessment version, , selected option, rationale, necessary controls, and the link to the where ISO/IEC 27001 applies. For each action, distinguish the risk owner who approves the plan and decides on from the person responsible for implementation.

Delivery: proposed actions, resources and contingencies, dependencies and sequencing, constraints, start and completion dates, priority, implementation status, cost level, and reporting cadence.
Effectiveness: performance indicators, implementation checks, operating-effectiveness tests, evidence owner, test date, tolerance or success criterion, and follow-up assessment.
Decision control: plan version, risk-owner approval, expected and assumptions, acceptance status, conditions, monitoring indicators, review date, and change history.

Sources for this answer

ISO/IEC 27005:2022 standard page

ISO/IEC 27005:2022 clause 8.6.1 lists plan content including rationale, accountability, actions, resources, indicators, constraints, reporting, timing, status, testing, and cost.

Recommended next step

Keep the treatment plan tied to risk evidence

Assign implementation owners, retain delivery and effectiveness evidence, reassess residual risk, and set review triggers.

Assessment workflow

Track treatment actions and evidence

Assign implementation tasks, request effectiveness evidence, and schedule residual-risk reviews.

Explore next step

Talk to Sorena

Talk through implementation

Review your current scope, evidence gaps, and next implementation steps.

Explore next step

Section 3

How should teams formulate, approve, and implement the plan?

Select the treatment option from the evaluated risk and expected cost and benefit. Determine the controls needed from appropriate sources, including sector-specific and custom controls. Check each control's effect on consequence or likelihood and remove controls that do not contribute to the treatment decision.

Make the option concrete. ISO/IEC 27005 gives closing a flood-exposed office and choosing not to collect certain personal information as examples of avoidance. Modification can reduce likelihood or consequence. Sharing can use insurance or a contract, but at least one control still modifies the risk and the organization retains accountability for its decision.

Select: the and assessor choose avoidance, modification, retention, sharing, or a justified combination from the evaluated scenario, cost, benefit, urgency, and affected-party context.
Determine controls: control owners and specialists identify controls with more than a negligible effect on the risk, including custom or sector controls, and state whether each changes likelihood, consequence, or both.
Check completeness: compare the necessary controls for each risk with ISO/IEC 27001:2022 to find omissions; do not add a control only because it appears in Annex A or already exists.
Plan and approve: the plan owner sequences dependencies, resources, measures, contingencies, dates, reporting, and status; the is updated; the approves the plan.
Implement and decide: implementation owners retain delivery and effectiveness results, the assessor reassesses residual consequence and likelihood, and the authorized accepts the , adds conditions, escalates, or returns it for further treatment.

Sources for this answer

ISO/IEC 27005:2022 standard page

ISO/IEC 27005:2022 clauses 8.2-8.6 ground option selection, control necessity, Annex A comparison, plan approval, implementation follow-up, and acceptance.

ISO/IEC 27001:2022 standard page

ISO/IEC 27001:2022 clauses 6.1.3 and 8.3 require the treatment plan, its implementation, retained results, and owner decisions.

Section 4

Which treatment-planning mistakes should teams avoid?

Do not equate selecting an control with completing treatment. Annex A is a reference set for the completeness comparison. Necessary controls can come from other standards or be custom, and an Annex A control is not necessary for a particular risk merely because it already operates in the organization.

Risk sharing can delegate control implementation or share consequences, but it does not transfer the 's accountability for the remaining decision.
A project plan that ends at deployment is incomplete without effectiveness measures, follow-up assessment, residual-risk acceptance, and monitoring.
Do not assume every control must operate at maximum effectiveness; define the effectiveness needed for the risk to meet the acceptance criteria and verify that result.

Sources for this answer

ISO/IEC 27005:2022 standard page

ISO/IEC 27005:2022 explains the Annex A safety check, custom and sector controls, sharing, effectiveness tolerances, and the need to connect controls to specific risks.

ISO/IEC 27001:2022 standard page

ISO/IEC 27001:2022 states that Annex A controls are possible controls, are not exhaustive, and do not prevent additional necessary controls.

Section 5

When should the treatment plan be reviewed?

Review delivery against milestones and indicators throughout implementation. ISO/IEC 27005 sets no universal annual treatment-plan deadline. ISO/IEC 27001:2022 requires risk assessments at planned intervals and when significant changes are proposed or occur. Reassess after effectiveness testing and when a missed milestone, failed test, incident, new threat or vulnerability, changed requirement, cost or resource constraint, scope change, or control dependency invalidates the plan or expected .

The implementation owner updates action evidence and status; the reviews whether the plan still modifies the risk as intended.
When the treatment changes, repeat the necessary-control and completeness checks and update the where applicable.
After implementation, record measured control effectiveness and the follow-up residual assessment before renewing, changing, or rejecting acceptance.

Sources for this answer

ISO/IEC 27005:2022 standard page

ISO/IEC 27005:2022 clauses 5.2, 8.6.3, 9.2, and 10.5 ground implementation review, effectiveness assessment, residual-risk reassessment, and change-driven updates.

Primary sources

References and citations

ISO/IEC 27001:2022 standard page

iso.org

Referenced sections

ISO/IEC 27001:2022 states that Annex A controls are possible controls, are not exhaustive, and do not prevent additional necessary controls.

"Information security management systems — Requirements"

ISO/IEC 27005:2022 standard page

iso.org

Referenced sections

ISO/IEC 27005:2022 clauses 5.2, 8.6.3, 9.2, and 10.5 ground implementation review, effectiveness assessment, residual-risk reassessment, and change-driven updates.