{"id":666,"date":"2026-08-13T08:46:43","date_gmt":"2026-08-13T08:46:43","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=666"},"modified":"2026-08-13T08:46:43","modified_gmt":"2026-08-13T08:46:43","slug":"risk-treatment-plan","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/glossary\/risk-treatment-plan\/","title":{"rendered":"Risk Treatment Plan: Options and What to Record"},"content":{"rendered":"\n<!-- =========================================================================\n     OSTO GLOSSARY: RISK TREATMENT PLAN\n     Shared glossary design system. Paste into one Custom HTML block. No H1.\n     ========================================================================= -->\n\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n.og .p-yes{background:var(--sage-100);color:var(--sage-700)}\n.og .p-no{background:#eef0f4;color:var(--muted)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n\n<div class=\"og\">\n\n<p class=\"dek\">A risk treatment plan records what you decided to do about each risk you identified, which controls implement that decision, who owns it and by when.<\/p>\n\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Glossary<\/span><\/li>\n  <li><span class=\"tag t-sage\">Compliance<\/span><\/li>\n<\/ul>\n\n<div class=\"short\">\n  <p class=\"k\">The short answer<\/p>\n  <p>The risk treatment plan, or RTP, is the document that turns a risk register into action. For every risk above your acceptance threshold it states the treatment chosen, the controls that deliver it, the owner, the target date and the residual risk that remains afterwards. <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> requires it under Clause 6.1.3.<\/p>\n<\/div>\n\n<p>The <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> tells you what the risks are. The treatment plan is where someone commits to doing something about them.<\/p>\n\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#options\">The four treatment options<\/a><\/li>\n    <li><a href=\"#contains\">What the plan contains<\/a><\/li>\n    <li><a href=\"#residual\">Residual risk and sign-off<\/a><\/li>\n    <li><a href=\"#osto\">How Osto supports it<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"options\">The four treatment options<\/h2>\n\n<p>Every risk gets exactly one of these. Most get the first.<\/p>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 220\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Four risk treatment options: modify, avoid, share and retain.\">\n  <rect x=\"12\" y=\"34\" width=\"178\" height=\"150\" rx=\"16\" fill=\"#e9ecfa\"\/>\n  <text x=\"101\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"15\" font-weight=\"700\" fill=\"#4a52a8\">Modify<\/text>\n  <text x=\"101\" y=\"98\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">Apply controls to<\/text>\n  <text x=\"101\" y=\"115\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">reduce likelihood<\/text>\n  <text x=\"101\" y=\"132\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">or consequence<\/text>\n  <rect x=\"46\" y=\"150\" width=\"110\" height=\"22\" rx=\"11\" fill=\"#4a52a8\"\/>\n  <text x=\"101\" y=\"165\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#ffffff\">MOST RISKS<\/text>\n\n  <rect x=\"202\" y=\"34\" width=\"178\" height=\"150\" rx=\"16\" fill=\"#e3f0e9\"\/>\n  <text x=\"291\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"15\" font-weight=\"700\" fill=\"#3a6f5d\">Avoid<\/text>\n  <text x=\"291\" y=\"98\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">Stop doing the thing<\/text>\n  <text x=\"291\" y=\"115\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">that creates the risk<\/text>\n  <text x=\"291\" y=\"143\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-style=\"italic\" fill=\"#3a6f5d\">Retire the legacy service<\/text>\n\n  <rect x=\"392\" y=\"34\" width=\"178\" height=\"150\" rx=\"16\" fill=\"#e2eff7\"\/>\n  <text x=\"481\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"15\" font-weight=\"700\" fill=\"#2f6a89\">Share<\/text>\n  <text x=\"481\" y=\"98\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">Transfer part of the<\/text>\n  <text x=\"481\" y=\"115\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">exposure to another party<\/text>\n  <text x=\"481\" y=\"143\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-style=\"italic\" fill=\"#2f6a89\">Insurance, contractual terms<\/text>\n\n  <rect x=\"582\" y=\"34\" width=\"166\" height=\"150\" rx=\"16\" fill=\"#f0e6f3\"\/>\n  <text x=\"665\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"15\" font-weight=\"700\" fill=\"#6b4576\">Retain<\/text>\n  <text x=\"665\" y=\"98\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">Accept it knowingly,<\/text>\n  <text x=\"665\" y=\"115\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">with sign-off<\/text>\n  <text x=\"665\" y=\"143\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-style=\"italic\" fill=\"#6b4576\">Requires a named approver<\/text>\n<\/svg>\n<\/div>\n<figcaption><span class=\"swipe\">Swipe to see the full diagram. <\/span>Retaining a risk is a valid choice. Retaining one without recording who accepted it is not.<\/figcaption>\n<\/figure>\n\n<h2 id=\"contains\" class=\"c-sage\">What the plan contains<\/h2>\n\n<table class=\"h-sage\">\n  <thead>\n    <tr><th>Field<\/th><th>Why the auditor looks at it<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td><strong>Risk reference<\/strong><\/td><td>Ties the row back to the risk register so the chain can be followed<\/td><\/tr>\n    <tr><td><strong>Treatment option<\/strong><\/td><td>Shows a decision was made rather than deferred<\/td><\/tr>\n    <tr><td><strong>Controls selected<\/strong><\/td><td>Links the decision to specific <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a> references and to the SoA<\/td><\/tr>\n    <tr><td><strong>Owner and target date<\/strong><\/td><td><a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-evidence-collection\/\">Evidence<\/a> that the action is assigned and time-bound<\/td><\/tr>\n    <tr><td><strong>Status<\/strong><\/td><td>Whether the treatment is planned, in progress or complete<\/td><\/tr>\n    <tr><td><strong>Residual risk<\/strong><\/td><td>What remains after treatment, and whether that is acceptable<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<h2 id=\"residual\" class=\"c-apri\">Residual risk and sign-off<\/h2>\n\n<p>No control reduces a risk to zero. Whatever is left after treatment is the residual risk, and ISO 27001 requires risk owners to approve the plan and to accept the residual risks explicitly. That acceptance is a record, not a conversation.<\/p>\n\n<div class=\"callout\">\n  <p class=\"k\">The chain auditors follow<\/p>\n  <p>Risk register entry, then treatment decision, then selected control, then Statement of Applicability row, then evidence the control operates. A break anywhere in that chain is the most common finding at a Stage 2 audit.<\/p>\n<\/div>\n\n<h2 id=\"osto\">How Osto supports it<\/h2>\n\n<p>Where the treatment is modify, the controls have to exist and keep working. Osto deploys and runs those technical controls, and maps their evidence to the Annex A references cited in the plan, so a row marked complete can be demonstrated. Treatment decisions, owners and residual risk acceptance remain with the organisation.<\/p>\n\n<p class=\"related\"><strong>Product documentation:<\/strong> Setup guides and technical reference are available in the <a href=\"https:\/\/docs.osto.one\/\" target=\"_blank\" rel=\"noopener\">Osto documentation<\/a>.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Free security assessment<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">Where the treatment is modify, the controls have to work<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Osto deploys and runs those controls, and maps the evidence to the Annex A references your plan cites.<\/p>\n  <a href=\"https:\/\/osto.one\/contact\/\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 30px;border-radius:12px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Get a free security assessment<\/span><\/a>\n  <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:transparent;color:#ffffff;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:600;font-size:16px;text-decoration:none;border:1.5px solid rgba(255,255,255,.5);border-radius:12px;padding:13px 28px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a platform walkthrough<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:14px 0 0;\">Deploys in hours &middot; Mapped to your plan &middot; One platform, everything<\/p>\n<\/div>\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n\n<details>\n  <summary>What is a risk treatment plan?<\/summary>\n  <p>It is the document recording what an organisation decided to do about each identified risk: the treatment option chosen, the controls implementing it, the owner, the target date and the residual risk remaining. ISO 27001 requires it under Clause 6.1.3.<\/p>\n<\/details>\n\n<details>\n  <summary>What are the risk treatment options?<\/summary>\n  <p>Four: modify the risk by applying controls, avoid it by ceasing the activity, share it with another party through insurance or contract, or retain it by accepting it knowingly with documented sign-off.<\/p>\n<\/details>\n\n<details>\n  <summary>How is it different from the Statement of Applicability?<\/summary>\n  <p>The treatment plan records decisions and actions per risk. The Statement of Applicability records, per Annex A control, whether it applies and why. The plan explains the reasoning; the SoA is the control-by-control view of the result.<\/p>\n<\/details>\n\n<details>\n  <summary>Can a risk simply be accepted?<\/summary>\n  <p>Yes, if it falls within the acceptance criteria set during the risk assessment and a named risk owner signs off. Acceptance without a record is treated as an unmanaged risk.<\/p>\n<\/details>\n\n<p class=\"related\"><strong>Related glossary terms:<\/strong> <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">Risk Assessment<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">ISMS<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A Controls<\/a> &middot; Residual Risk<\/p>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A risk treatment plan records what you decided to do about each risk you identified, which controls implement that decision,\u2026<\/p>\n","protected":false},"author":8,"featured_media":667,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[180],"tags":[],"class_list":["post-666","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-glossary"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=666"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/666\/revisions"}],"predecessor-version":[{"id":668,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/666\/revisions\/668"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/667"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}