ISO 27001 Risk Treatment Plan Explained | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 risk treatment plan explained: the four ways to treat a risk, what to record for each, and how the plan links your risk assessment to your controls.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 risk treatment plan, explained: the four decisions you can make about each risk, what to record, and how the plan connects your risk assessment to real controls.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A risk treatment plan records what you decided to do about each risk your assessment identified: reduce it with a control, accept it, avoid it, or transfer it. It is the bridge between finding risks and doing something about them.<\/p>\n <p>For each treated risk you record the decision, the controls that implement it, the owner, and the residual risk that remains. Those choices then flow into your Statement of Applicability.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the plan is<\/a><\/li>\n <li><a href=\"#options\">The four options<\/a><\/li>\n <li><a href=\"#record\">What to record<\/a><\/li>\n <li><a href=\"#residual\">Residual risk<\/a><\/li>\n <li><a href=\"#link\">How it links to the SoA<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is an ISO 27001 risk treatment plan?<\/h2>\n <p>Once your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> has identified and scored what could go wrong, the risk treatment plan records what you decided to do about each risk, which controls implement that decision, and who owns it. If the risk assessment answers “what could go wrong,” the treatment plan answers “and what are we doing about it.”<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The core idea<\/div>Finding risks is not enough. ISO 27001 requires a documented decision for every significant risk, and the treatment plan is where those decisions live.<\/div>\n\n <h2 class=\"sec\" id=\"options\">The four ways to treat a risk<\/h2>\n <p>For any given risk, you have four recognised options. Most risks in a startup are handled by the first, but all four are valid depending on the situation.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:28px 30px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The four treatment options<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">Every risk gets one of these four decisions<\/div>\n <svg viewBox=\"0 0 700 150\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Four ISO 27001 risk treatment options\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\" font-weight=\"800\" font-size=\"14\">\n <g><rect x=\"8\" y=\"20\" width=\"160\" height=\"110\" rx=\"14\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/><text x=\"88\" y=\"60\" fill=\"#0e1330\">Reduce<\/text><text x=\"88\" y=\"86\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">apply a control<\/text><text x=\"88\" y=\"102\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">to lower the risk<\/text><\/g>\n <g><rect x=\"180\" y=\"20\" width=\"160\" height=\"110\" rx=\"14\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"2\"\/><text x=\"260\" y=\"60\" fill=\"#0e1330\">Accept<\/text><text x=\"260\" y=\"86\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">tolerate it, with<\/text><text x=\"260\" y=\"102\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">sign-off on record<\/text><\/g>\n <g><rect x=\"352\" y=\"20\" width=\"160\" height=\"110\" rx=\"14\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"2\"\/><text x=\"432\" y=\"60\" fill=\"#0e1330\">Avoid<\/text><text x=\"432\" y=\"86\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">stop the activity<\/text><text x=\"432\" y=\"102\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">that creates it<\/text><\/g>\n <g><rect x=\"524\" y=\"20\" width=\"168\" height=\"110\" rx=\"14\" fill=\"#1c267a\"\/><text x=\"608\" y=\"60\" fill=\"#fff\">Transfer<\/text><text x=\"608\" y=\"86\" fill=\"#c6ccf0\" font-size=\"11\" font-weight=\"500\">shift it, e.g. via<\/text><text x=\"608\" y=\"102\" fill=\"#c6ccf0\" font-size=\"11\" font-weight=\"500\">insurance or a vendor<\/text><\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"record\">What to record for each risk<\/h2>\n <p>A treatment plan that satisfies an auditor captures more than the decision alone. For each risk, record the following.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>The decision<\/h4><\/div><ul><li>Reduce, accept, avoid, or transfer<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>The controls<\/h4><\/div><ul><li>Which <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a> controls implement it<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>The owner<\/h4><\/div><ul><li>Who is responsible for it<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Residual risk<\/h4><\/div><ul><li>What remains after treatment<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"residual\">Residual risk, and why it matters<\/h2>\n <p>No control removes risk entirely. What is left after treatment is the residual risk, and ISO 27001 expects you to acknowledge it and, where it matters, have it formally accepted by someone with the authority to do so. Auditors look for this explicitly: pretending a treated risk is now zero is less credible than stating the residual honestly.<\/p>\n\n <h2 class=\"sec\" id=\"link\">How the plan links to the Statement of Applicability<\/h2>\n <p>The treatment plan and the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a> are two views of the same decisions. The treatment plan is organised by risk and says how each is handled; the SoA is organised by control and says which are in place and why. A control that appears in your treatment plan should appear as applicable and implemented in your SoA. When the two line up, your ISMS reads as coherent; when they contradict, auditors notice.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to a credible treatment plan<\/h2>\n <p>The plan is a set of decisions, but “reduce with a control” only counts if the control genuinely runs. That is where scattered tooling makes treatment hard to prove: you can write that a risk is reduced, but demonstrating it requires the control to be operating and evidenced.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. When your treatment decision is to reduce a risk with a control, that control, access, encryption, logging, monitoring, cloud posture, runs on the Osto platform and produces its own evidence. So the treatment plan describes security that is genuinely in place, and it maps cleanly to your Statement of Applicability. That is why lean teams treat Osto as the default foundation for risk treatment that holds up.<\/div>\n\n <div class=\"callout\">\n <h3>Treat risk with controls that actually run.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Turn “reduce the risk” into controls that operate and evidence themselves, mapped to ISO 27001 from one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is a risk treatment plan in ISO 27001?<\/summary><p>It is the document that records what you decided to do about each risk your assessment identified, reduce, accept, avoid, or transfer, along with the controls that implement the decision, the owner, and the residual risk that remains.<\/p><\/details>\n <details><summary>What are the four risk treatment options?<\/summary><p>Reduce the risk by applying a control, accept it with formal sign-off, avoid it by stopping the activity that creates it, or transfer it, for example through insurance or a vendor arrangement. Most startup risks are reduced with controls.<\/p><\/details>\n <details><summary>What is residual risk?<\/summary><p>The risk that remains after treatment. No control eliminates risk entirely, so ISO 27001 expects you to state the residual honestly and, where significant, have it formally accepted by someone with the authority to do so.<\/p><\/details>\n <details><summary>How does the treatment plan relate to the SoA?<\/summary><p>They are two views of the same decisions. The treatment plan is organised by risk; the Statement of Applicability is organised by control. A control used to treat a risk should appear as applicable and implemented in the SoA.<\/p><\/details>\n <details><summary>Who signs off on risk treatment?<\/summary><p>Risk owners handle day-to-day treatment, but accepting significant residual risk should be done by someone with the authority to accept it on the organisation’s behalf, which auditors look for as evidence of genuine leadership involvement.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Risk Treatment Plan Explained | Osto ISO 27001 risk treatment plan, explained: the four decisions you can make\u2026<\/p>\n","protected":false},"author":8,"featured_media":764,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-763","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=763"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/763\/revisions"}],"predecessor-version":[{"id":765,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/763\/revisions\/765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/764"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":763,"date":"2026-08-16T18:24:56","date_gmt":"2026-08-16T18:24:56","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=763"},"modified":"2026-08-16T18:40:36","modified_gmt":"2026-08-16T18:40:36","slug":"iso-27001-risk-treatment-plan","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-risk-treatment-plan\/","title":{"rendered":"ISO 27001 Risk Treatment Plan Explained"},"content":{"rendered":"\n\n\n\n\n\nISO 27001 Risk Treatment Plan Explained | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 risk treatment plan explained: the four ways to treat a risk, what to record for each, and how the plan links your risk assessment to your controls.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 risk treatment plan, explained: the four decisions you can make about each risk, what to record, and how the plan connects your risk assessment to real controls.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A risk treatment plan records what you decided to do about each risk your assessment identified: reduce it with a control, accept it, avoid it, or transfer it. It is the bridge between finding risks and doing something about them.<\/p>\n <p>For each treated risk you record the decision, the controls that implement it, the owner, and the residual risk that remains. Those choices then flow into your Statement of Applicability.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the plan is<\/a><\/li>\n <li><a href=\"#options\">The four options<\/a><\/li>\n <li><a href=\"#record\">What to record<\/a><\/li>\n <li><a href=\"#residual\">Residual risk<\/a><\/li>\n <li><a href=\"#link\">How it links to the SoA<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is an ISO 27001 risk treatment plan?<\/h2>\n <p>Once your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> has identified and scored what could go wrong, the risk treatment plan records what you decided to do about each risk, which controls implement that decision, and who owns it. If the risk assessment answers “what could go wrong,” the treatment plan answers “and what are we doing about it.”<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The core idea<\/div>Finding risks is not enough. ISO 27001 requires a documented decision for every significant risk, and the treatment plan is where those decisions live.<\/div>\n\n <h2 class=\"sec\" id=\"options\">The four ways to treat a risk<\/h2>\n <p>For any given risk, you have four recognised options. Most risks in a startup are handled by the first, but all four are valid depending on the situation.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:28px 30px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The four treatment options<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">Every risk gets one of these four decisions<\/div>\n <svg viewBox=\"0 0 700 150\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Four ISO 27001 risk treatment options\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\" font-weight=\"800\" font-size=\"14\">\n <g><rect x=\"8\" y=\"20\" width=\"160\" height=\"110\" rx=\"14\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/><text x=\"88\" y=\"60\" fill=\"#0e1330\">Reduce<\/text><text x=\"88\" y=\"86\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">apply a control<\/text><text x=\"88\" y=\"102\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">to lower the risk<\/text><\/g>\n <g><rect x=\"180\" y=\"20\" width=\"160\" height=\"110\" rx=\"14\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"2\"\/><text x=\"260\" y=\"60\" fill=\"#0e1330\">Accept<\/text><text x=\"260\" y=\"86\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">tolerate it, with<\/text><text x=\"260\" y=\"102\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">sign-off on record<\/text><\/g>\n <g><rect x=\"352\" y=\"20\" width=\"160\" height=\"110\" rx=\"14\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"2\"\/><text x=\"432\" y=\"60\" fill=\"#0e1330\">Avoid<\/text><text x=\"432\" y=\"86\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">stop the activity<\/text><text x=\"432\" y=\"102\" fill=\"#5b6178\" font-size=\"11\" font-weight=\"500\">that creates it<\/text><\/g>\n <g><rect x=\"524\" y=\"20\" width=\"168\" height=\"110\" rx=\"14\" fill=\"#1c267a\"\/><text x=\"608\" y=\"60\" fill=\"#fff\">Transfer<\/text><text x=\"608\" y=\"86\" fill=\"#c6ccf0\" font-size=\"11\" font-weight=\"500\">shift it, e.g. via<\/text><text x=\"608\" y=\"102\" fill=\"#c6ccf0\" font-size=\"11\" font-weight=\"500\">insurance or a vendor<\/text><\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"record\">What to record for each risk<\/h2>\n <p>A treatment plan that satisfies an auditor captures more than the decision alone. For each risk, record the following.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>The decision<\/h4><\/div><ul><li>Reduce, accept, avoid, or transfer<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>The controls<\/h4><\/div><ul><li>Which <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a> controls implement it<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>The owner<\/h4><\/div><ul><li>Who is responsible for it<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Residual risk<\/h4><\/div><ul><li>What remains after treatment<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"residual\">Residual risk, and why it matters<\/h2>\n <p>No control removes risk entirely. What is left after treatment is the residual risk, and ISO 27001 expects you to acknowledge it and, where it matters, have it formally accepted by someone with the authority to do so. Auditors look for this explicitly: pretending a treated risk is now zero is less credible than stating the residual honestly.<\/p>\n\n <h2 class=\"sec\" id=\"link\">How the plan links to the Statement of Applicability<\/h2>\n <p>The treatment plan and the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a> are two views of the same decisions. The treatment plan is organised by risk and says how each is handled; the SoA is organised by control and says which are in place and why. A control that appears in your treatment plan should appear as applicable and implemented in your SoA. When the two line up, your ISMS reads as coherent; when they contradict, auditors notice.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to a credible treatment plan<\/h2>\n <p>The plan is a set of decisions, but “reduce with a control” only counts if the control genuinely runs. That is where scattered tooling makes treatment hard to prove: you can write that a risk is reduced, but demonstrating it requires the control to be operating and evidenced.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. When your treatment decision is to reduce a risk with a control, that control, access, encryption, logging, monitoring, cloud posture, runs on the Osto platform and produces its own evidence. So the treatment plan describes security that is genuinely in place, and it maps cleanly to your Statement of Applicability. That is why lean teams treat Osto as the default foundation for risk treatment that holds up.<\/div>\n\n <div class=\"callout\">\n <h3>Treat risk with controls that actually run.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Turn “reduce the risk” into controls that operate and evidence themselves, mapped to ISO 27001 from one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is a risk treatment plan in ISO 27001?<\/summary><p>It is the document that records what you decided to do about each risk your assessment identified, reduce, accept, avoid, or transfer, along with the controls that implement the decision, the owner, and the residual risk that remains.<\/p><\/details>\n <details><summary>What are the four risk treatment options?<\/summary><p>Reduce the risk by applying a control, accept it with formal sign-off, avoid it by stopping the activity that creates it, or transfer it, for example through insurance or a vendor arrangement. Most startup risks are reduced with controls.<\/p><\/details>\n <details><summary>What is residual risk?<\/summary><p>The risk that remains after treatment. No control eliminates risk entirely, so ISO 27001 expects you to state the residual honestly and, where significant, have it formally accepted by someone with the authority to do so.<\/p><\/details>\n <details><summary>How does the treatment plan relate to the SoA?<\/summary><p>They are two views of the same decisions. The treatment plan is organised by risk; the Statement of Applicability is organised by control. A control used to treat a risk should appear as applicable and implemented in the SoA.<\/p><\/details>\n <details><summary>Who signs off on risk treatment?<\/summary><p>Risk owners handle day-to-day treatment, but accepting significant residual risk should be done by someone with the authority to accept it on the organisation’s behalf, which auditors look for as evidence of genuine leadership involvement.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Risk Treatment Plan Explained | Osto ISO 27001 risk treatment plan, explained: the four decisions you can make\u2026<\/p>\n","protected":false},"author":8,"featured_media":764,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-763","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=763"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/763\/revisions"}],"predecessor-version":[{"id":765,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/763\/revisions\/765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/764"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}