ISO 27001 clause 8.3: Implementing risk treatment
ISO 27001 clause 8.3 requires the organisation to implement its information security risk-treatment plan and retain documented results. This is where planned safeguards and other treatment decisions become operating arrangements. A plan marked “approved” or a tool marked “purchased” does not by itself show implementation.
What clause 8.3 requires in practice
Clause 8.3 is short but demanding: the organisation carries out the risk treatment plan it approved, and keeps documented information on what resulted. The plan itself, including selecting options, determining controls and preparing the statement of applicability, is created in clause 6.1.3. This clause is about delivery. Treatment actions agreed in the plan have to be completed and operate, and there should be a retained record of the results.
The distinction matters because many organisations produce a thorough plan and then let actions slip. An auditor will compare the plan with reality, asking whether each action happened, who did it and what shows it works. The outputs are implemented controls and records of outcome, such as completed tasks, tested arrangements and any treatment that was changed or abandoned, with a reason. The clause does not prescribe a tracker or a style of record; those are the organisation's choice.
Translate the plan into executable work
Use the decisions made under clause 6.1.3 to identify the necessary activities, owners and dependencies. A selected control may need a policy decision, configuration, staff capability, supplier agreement and ongoing review. Assigning only the technical installation can leave much of the intended treatment incomplete.
Make acceptance of the work clear. What result would demonstrate that the arrangement is operating as intended? A process owner should be able to explain the evidence needed, not merely confirm that an invoice was paid. The appropriate validation depends on the control and risk; ISO 27001 does not require the same test for every treatment.
Manage status accurately
Distinguish planned, partly implemented and implemented arrangements. Keep the Statement of Applicability’s implementation information consistent with reality. If a control exists at one site but the relevant scope includes others, do not silently generalise the status across the whole system.
Escalate delays and changed assumptions to the appropriate owner. Risk-owner approval and residual-risk acceptance belong to the treatment process; an overdue action should not be treated as implicitly accepted. Consider interim measures and updated decisions where necessary, without using a temporary arrangement indefinitely to avoid resolving the underlying exposure.
Implementation can reveal new information. A planned solution may not work with a legacy process or a supplier may not provide the expected capability. Revisit the assessment or treatment decision when needed. Traceability is more valuable than preserving the appearance that the original plan was perfect.
Why risk treatment matters to the business
A treatment plan only reduces risk when it is carried out. Unfinished actions leave exposures that management believes are covered, which is arguably worse than a known gap. Delivery also determines whether the investment in assessment was worthwhile and whether residual risk, accepted by owners, is in fact the residual risk the business carries. Customers and assessors look for follow-through because it is the best predictor of future behaviour. Visible completion records protect leaders when an incident occurs, showing that reasonable steps were taken. Good delivery discipline also reveals when a planned control is unworkable, allowing a timely change of approach.
How to implement clause 8.3
Good delivery relies on ownership and visibility more than on tools. A suggested approach follows. Keep the focus on finishing, because a short list of completed treatments is worth more than a long list of started ones. Include a plain note on any action dropped or changed.
- Convert each approved treatment into a concrete action with an owner, resources and a target date agreed with that owner.
- Sequence actions by risk and dependency, and be accurate about capacity so the plan is credible.
- Review progress regularly and escalate blocked items to someone able to remove the obstacle.
- Confirm that each completed control works, using a test, a walkthrough or sampled records.
- Record what was done, including any change of approach and the reason for it.
- Update the residual risk position when a control is complete or fails, and tell the risk owner.
- Report status to management so that overdue treatment is a visible decision rather than a silent drift.
Illustrative examples
The company deploys an authentication feature but initially leaves service accounts and emergency access outside the implementation. Validation identifies the gap. The owner updates the plan, tests the relevant routes and records remaining exceptions and decisions. Procurement completion alone would have overstated the treatment result.
The plan includes protected copies of important production information and a recovery procedure. A restoration exercise reveals that the information is available but the application configuration cannot yet be recovered reliably. The organisation records the result and completes further work before presenting the treatment as fully implemented.
Evidence of treatment results
Retain documented information showing the results of treatment. This may include configuration validation, operating samples, approved procedures, exercised arrangements, supplier evidence and relevant decisions. Choose evidence that addresses the intended treatment rather than accumulating screenshots unrelated to the risk.
An auditor may follow a treatment action from the approved plan to its implementation and current operating evidence. Check whether the responsible owner understands the result and whether continuing responsibilities are assigned. A control that worked during a project demonstration but is no longer maintained may not support the claimed status.
Common mistakes
Avoid closing every action at the end of a project regardless of outstanding dependencies, treating a risk acceptance as permission to ignore applicable obligations or assuming vendor assurances prove configuration in your environment. Another weakness is failing to update records after treatment changes.
Connect implementation with monitoring and evaluation. Initial validation and ongoing performance answer different questions. The organisation needs confidence both that the planned arrangement was implemented and that it continues to support the intended outcome.
Frequently asked questions
Does buying a security tool complete risk treatment?
Not by itself. Verify the necessary configuration, processes, responsibilities and operating result associated with the treatment decision.
What should happen when a treatment action is delayed?
Escalate the exposure and dependencies to the appropriate owner, consider suitable interim measures and update decisions and status. Delay should not be treated as automatic risk acceptance.
Can the Statement of Applicability say a control is implemented before rollout ends?
Its implementation information should accurately reflect the relevant scope. Distinguish partial rollout and outstanding work rather than implying complete operation everywhere.
Turn treatment decisions into demonstrable results
Talk to Sterling to check implementation of your risk treatment plan and the evidence retained for completed actions, gaps and operating results. Build the relevant knowledge through Risk Management at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.