Templates and records · ISO 27001 · Clause 6.1.3

ISO 27001 risk treatment plan template

What will be done about each risk that is not accepted: with which controls, by whom, by when and what risk remains afterwards, approved by its owner.

In one sentence

The risk treatment plan sets out, for each risk that is not accepted, the option chosen —mitigate, avoid, transfer or accept—, the controls to be applied, the person responsible and the deadline, and the owner’s approval together with their acceptance of the residual risk, which is what clause 6.1.3 e) and f) of ISO/IEC 27001 requires.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27001 · Clause 6.1.3 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
Type of information: Mandatory record A documented process (6.1.3) and results to be retained (8.3)
Who fills it in: Information security manager and risk owners The owner approves the plan and signs off acceptance of the residual risk
When: After every risk assessment Progress is reviewed at the security committee and in the management review
How long it is kept: Set by the organisation ISO/IEC 27001 sets no periods: it asks you to decide on the retention and disposition of documented information (7.5.3). Covering the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 27001 demands and what it leaves to your judgement

With the risks rated, the standard asks you to choose treatment options, determine the necessary controls, formulate a plan and obtain the risk owners’ approval of the plan and acceptance of the residual risk.

The plan is not the statement of applicability: the SoA says which controls exist and why; the plan says what is done, by whom and when to reach that state. Both draw on the same assessment.

Implementation of the plan is followed up under clause 8: it has to be carried out and its results retained, so that the audit shows what has been done, what is outstanding and why.

Read it in context: Planning, in the ISO 27001 Academy

Structure

Fields the template should include

Risk treated and level before treatment
Treatment option: mitigate, avoid, transfer or accept
Planned controls or actions (with their Annex A reference, if any)
Person responsible and target date
Resources required
Expected residual risk level
Owner’s approval and acceptance of the residual risk
Status and closing date

Example

Example: treating the risk of a provider outage

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Risk	R-07 · Level 10, high
Option	Mitigate
Action T-07	Replicate the platform in a second region with tested failover (controls 5.30 and 8.14)
Owner and deadline	Head of infrastructure · 31 January 2027
Resources	Approved budget of €18,000 a year
Expected residual risk	Level 5, acceptable
Approval	Operations director, 10 September 2026; accepts the residual risk
Status	In progress · 60%

At the audit

Mistakes auditors commonly flag

The plan has no dates or owners: it is a list of good intentions.
There is no record of the owner accepting the residual risk.
Risks “transferred” to an insurer or a supplier without checking what the contract covers.
Actions closed in the plan that are not reflected in the statement of applicability.

In Kimobox

How this record is kept in Kimobox

1Each action in the plan is assigned to an owner with a date, and the system sends an alert if it slips.
2The treatment is recorded alongside the risk and its owner, with their approval.
3The management review starts from a template with security incidents and risks already compiled.

Frequently asked questions

What people ask us before getting started

Can a high risk be accepted?

Yes, if its owner accepts it knowingly and it is recorded. The standard does not forbid accepting risks above the criterion; it asks for the decision to be explicit and taken by someone with the authority to take it.

Can the treatment plan and the SoA be the same document?

They can live in the same tool, but they answer different questions. Merging them tends to lose either the follow-up of actions or the justification of controls.

Keep your ISO 27001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
ISO/IEC 27005:2022 — Guidance on managing information security risks ISO/IEC · October 2022