Clause 8.3 Information security risk treatment
Clause 8.3 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Information security risk treatment. The risk treatment plan must be put into effect, and documented information on the results of risk treatment must be retained.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 8.3 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 8), in our words, not a statement of the standard and not binding on an assessor.
- Evidence that actions in the risk treatment plan were implemented, such as change or project records
- Retained records of treatment results and residual risk
- Tracking of treatment actions with owners and dates
- Updates to the SoA reflecting implementation status