Revision as of 20:40, 4 March 2026 by hw>Aebersbach
The organization shall select treatment options, determine necessary controls, compare with Annex A, produce a Statement of Applicability (SoA), implement a plan, and retain documented information.
What this means in practice: Move from risk lists to implemented controls—choose a treatment per risk, justify controls in the SoA, execute the plan, and prove completion.
To make this concrete, the organization must ensure:
a. Treatment options are chosen (reduce/avoid/transfer/accept) and necessary controls are determined.
b. The SoA is created and maintained (included/excluded controls with justification; implementation status).
c. A treatment plan is implemented and tracked (owners, deadlines, resources) with retained evidence.
