ISO 27001 Risk Treatment Plan: Templates & SMB Guide

An ISO 27001 risk treatment plan is the operational backbone of your entire information security management system — without it, your risk assessment is just a document that collects dust. For SMBs navigating ISO 27001 certification for the first time, building a risk treatment plan that satisfies auditors while remaining practical for a lean team is one of the most challenging steps in the process. This guide breaks down exactly what belongs in your plan, provides a working template structure, and shows you how to move from risk identification to documented, auditable treatment decisions without hiring a room full of consultants.

What Is an ISO 27001 Risk Treatment Plan?

Under ISO/IEC 27001:2022, Clause 6.1.3 requires organizations to define and apply an information security risk treatment process. The risk treatment plan (RTP) is the formal output of that process — a structured document that records every identified risk, the treatment option selected, the controls applied, the control owner, implementation status, and residual risk acceptance.

Think of it this way: your risk assessment answers "what could go wrong and how bad would it be?" Your risk treatment plan answers "what are we doing about it, who owns it, and when will it be done?"

The standard gives you four treatment options for each risk:

• Modify (Mitigate): Implement controls to reduce the likelihood or impact of the risk.
• Avoid: Eliminate the activity or condition that creates the risk entirely.
• Share (Transfer): Shift the risk to a third party, such as through cyber insurance or a managed security provider.
• Retain (Accept): Consciously accept the risk because the cost of treatment exceeds the potential impact, documented with formal sign-off.

Every risk in your register must be assigned one of these options. Leaving risks without a documented treatment decision is one of the most common nonconformities auditors flag during Stage 2 assessments.

Core Components of an ISO 27001 Risk Treatment Plan Template

A compliant RTP doesn't need to be a 200-page behemoth. For most SMBs, a well-structured spreadsheet or purpose-built platform entry covers everything required. Here are the fields every risk treatment plan must include:

Field	Description	Example
Risk ID	Unique identifier linking back to the risk register	RISK-042
Risk Description	Clear statement of the threat, vulnerability, and potential impact	Unauthorized access to customer PII via compromised admin credentials
Inherent Risk Score	Likelihood × Impact before any controls are applied	4 × 5 = 20 (Critical)
Treatment Option	Modify / Avoid / Share / Retain	Modify
Selected Controls	Annex A control references and descriptions	A.8.5 (Privileged Access Management), A.8.2 (MFA)
Control Owner	Named individual responsible for implementation	Head of IT / CISO
Implementation Deadline	Target date for control to be operational	2024-09-30
Implementation Status	Not Started / In Progress / Implemented / Verified	In Progress
Residual Risk Score	Likelihood × Impact after controls are applied	2 × 5 = 10 (Medium)
Risk Acceptance	Formal sign-off by risk owner that residual risk is acceptable	Accepted by CTO — 2024-10-01
Review Date	Next scheduled review of this risk and its treatment	2025-04-01

Linking Your RTP to the Statement of Applicability (SoA)

One area where SMBs frequently stumble is the relationship between the risk treatment plan and the Statement of Applicability. The SoA lists all 93 controls from Annex A of ISO 27001:2022 and documents whether each is applicable, why it was included or excluded, and its implementation status. Your RTP must be consistent with your SoA — every control you select in the RTP should appear as "applicable and implemented" in the SoA, and every exclusion must be justified.

Auditors will cross-reference these two documents. Inconsistencies between them — such as a control listed as "not applicable" in the SoA but referenced in the RTP — are a fast path to a major nonconformity.

Building Your ISO 27001 Risk Treatment Plan: A Step-by-Step Process for SMBs

The following process is designed for organizations with limited dedicated security staff. It prioritizes auditability and practical execution over theoretical completeness.

Step 1: Complete Your Risk Assessment First

You cannot build a treatment plan without a completed risk assessment. Your risk assessment must identify assets, threats, vulnerabilities, and calculate inherent risk scores using a consistent, documented methodology. The NIST Cybersecurity Framework is a useful reference for structuring threat categories, even within an ISO 27001 context.

For SMBs, a 5×5 likelihood-impact matrix is typically sufficient. What matters most is consistency — use the same scoring criteria for every risk so your results are defensible.

Step 2: Prioritize Risks Above Your Acceptance Threshold

Define your risk acceptance criteria before you start assigning treatment options. This is a management decision, not a technical one. For example, your organization might decide that any risk scoring 15 or above on a 25-point scale requires active treatment, while risks below 8 may be retained with documented acceptance.

This threshold should be documented in your risk management policy and approved by senior leadership. Without it, every treatment decision becomes subjective and difficult to defend under audit.

Step 3: Select Treatment Options and Map to Annex A Controls

For risks requiring modification, map each one to the relevant controls from ISO 27001:2022 Annex A. The 2022 revision reorganized controls into four themes: Organizational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls). New controls introduced in the 2022 update — such as A.5.7 (Threat Intelligence), A.8.16 (Monitoring Activities), and A.8.23 (Web Filtering) — are particularly relevant for SMBs operating cloud-first environments.

Avoid the temptation to select every control for every risk. Over-scoping your control set creates implementation debt and makes your SoA harder to maintain. Be precise: select the controls that directly address the specific threat and vulnerability combination you've identified.

Step 4: Assign Owners and Set Realistic Deadlines

Every control in your treatment plan needs a named owner — not a team or department, but a specific individual who is accountable for implementation. For SMBs, this often means the same person owns multiple controls. That's fine, but be realistic about capacity when setting deadlines.

A common mistake is setting all implementation deadlines to the same date (usually the certification audit date). This creates a last-minute scramble and produces controls that exist on paper but haven't been operationalized. Stagger your deadlines based on control complexity and business priority.

Step 5: Calculate Residual Risk and Obtain Formal Acceptance

After documenting your planned controls, recalculate the risk score to produce a residual risk value. This represents the risk that remains after your controls are fully implemented. Residual risk must be formally accepted by the risk owner — typically a senior manager or executive — and that acceptance must be documented with a name, date, and signature (or electronic equivalent).

ISO 27001 does not require you to eliminate all risk. It requires you to demonstrate that you have made conscious, documented decisions about which risks are acceptable and why.

Step 6: Review and Update Continuously

Your risk treatment plan is a living document. ISO 27001 Clause 9.3 (Management Review) and Clause 10.2 (Continual Improvement) both require that your ISMS — including your RTP — be reviewed at planned intervals and updated when significant changes occur. Triggers for an unscheduled review include new system deployments, significant incidents, changes in the threat landscape, or organizational restructuring.

Common Mistakes SMBs Make With Risk Treatment Plans

• Treating the RTP as a one-time exercise: Certification auditors want to see evidence of ongoing review, not a document created six months ago and never touched.
• Vague control descriptions: "Implement security controls" is not an acceptable entry. Be specific: "Deploy MFA on all administrative accounts using [tool name] by [date]."
• Missing risk acceptance sign-offs: Retained risks without documented management approval are a nonconformity waiting to happen.
• Disconnected SoA and RTP: These two documents must tell a consistent story. Build them in parallel, not sequentially.
• Ignoring supplier and third-party risks: ISO 27001:2022 places increased emphasis on supply chain security (A.5.19–A.5.22). Your RTP should include risks associated with critical vendors and cloud providers.

How ComplyGuard Accelerates Your ISO 27001 Risk Treatment Plan

Building and maintaining a compliant risk treatment plan manually — across spreadsheets, shared drives, and email threads — is time-consuming and error-prone. ComplyGuard's AI-powered compliance platform automates the most labor-intensive parts of the process: it maps your identified risks to relevant Annex A controls automatically, tracks implementation status in real time, flags overdue treatment actions, and maintains the audit trail your certification body will expect to see.

Unlike generic GRC tools built for enterprise security teams, ComplyGuard is designed specifically for SMBs that need to achieve certification without a dedicated compliance department. The platform keeps your RTP and SoA synchronized automatically, so you're never caught with inconsistent documentation during an audit. You can compare ComplyGuard to traditional compliance approaches to see exactly how much time and cost you can save versus building your ISMS manually or engaging an external consultant.

The ISO 27001 standard is designed to be scalable — and with the right tooling, even a 20-person company can build a certification-ready ISMS without months of consulting fees.

Conclusion

A well-constructed ISO 27001 risk treatment plan is not just a compliance checkbox — it's a practical management tool that helps your organization make informed, defensible decisions about information security risk. By following a structured process, linking your RTP to your SoA, assigning clear ownership, and committing to regular review, SMBs can build a risk treatment plan that satisfies auditors and genuinely improves security posture. The key is to start with the right framework, stay consistent, and treat the plan as a living document rather than a one-time deliverable.

Ready to stop building compliance documents from scratch? Explore ComplyGuard's pricing plans and see how our platform can have your ISO 27001 risk treatment plan audit-ready in days, not months — or talk to our team to get a personalized walkthrough of how ComplyGuard maps to your specific certification goals.