ISO 27001/Chapter/8.3 Information security risk treatment

The organization shall select treatment options, determine necessary controls, compare with Annex A, produce a Statement of Applicability (SoA), implement a plan, and retain documented information.

What this means in practice: Move from risk lists to implemented controls—choose a treatment per risk, justify controls in the SoA, execute the plan, and prove completion.

To make this concrete, the organization must ensure:

a. Treatment options are chosen (reduce/avoid/transfer/accept) and necessary controls are determined.

b. The SoA is created and maintained (included/excluded controls with justification; implementation status).

c. A treatment plan is implemented and tracked (owners, deadlines, resources) with retained evidence.