6.1.3Information security risk treatment - Actions to address risks and opportunities

The organization shall define and apply an information security risk treatment process to:

a) select appropriate information security risk treatment options, taking account of the risk assessment results;

b) determine all controls that are necessary to implement the information security risk treatment option(s) chosen;

c) compare the controls determined in 6.1.3 b) above with those in Annex A and verify that no necessary controls have been omitted;

d) produce a Statement of Applicability that contains:

e) formulate an information security risk treatment plan; and

f) obtain risk owners’ approval of the information security risk treatment plan and acceptance of the residual information security risks.