ISO 27001 Clause 8 Clause 8.3

ISO 27001 clause 8.3 Information security risk treatment

The basics

ISO 27001 sub-clause 8.3 is called “Information security risk treatment” — this is a short sub-clause and it requires Risk Treatment Plan to be implemented.

Documentation

ISO 27001 clause 8.3 Information security risk treatment requires writing the following document:

Implementation

To implement ISO 27001 clause 8.3 Information security risk treatment, you need to perform risk treatment at planned intervals.

Audit evidence

The auditor will look for evidence that the information security Risk Treatment Plan is implemented.