Move from a risk to a treatment plan
Record the scenario, decide treatment and verify implemented controls.
Access: member. Subject to enabled modules and your plan.
How do you create a risk treatment plan?
A treatment plan connects a risk scenario to a decision, controls, owners and deadlines. In CISAPP, document the risk and its assessment, organize actions, then verify controls before reassessing residual risk. Creating tasks is part of follow-up, not evidence of risk reduction.
Preparation
Start with a precise fact or scenario, such as a vendor outage affecting a critical activity. Prepare context, ownership and assessment information.
Journey
- Check whether the risk already exists under Registers → Risks.
- Otherwise, create it with its scenario and affected entities.
- Assess likelihood and impact using the organization’s methodology.
- Decide a treatment strategy and record its justification.
- Add useful controls, owners and deadlines.
- Use an action plan if work involves multiple actions.
- Update controls as work progresses and verify evidence.
- Reassess residual risk, then use the appropriate lifecycle action.
The register helps find risks before preparing decisions. · Open full-size screenshot
If a gap must be tolerated temporarily
An administrator can prepare an exemption with justification, compensating controls and a deadline. An exemption does not replace risk treatment.
Success criteria
The scenario, decision, actions and residual level are reviewable. Do not close a risk solely because an action was created: implementation and verification should support the decision.
Expected outcome
The risk has a treatment approach, owners and tracking that can be reviewed at the next checkpoint.
Common questions
What is the difference between a treatment plan and an action plan?
Treatment explains how the risk is addressed and how its level will be reviewed. An action plan organizes actions and their completion. Link actions to the risk to preserve the decision context.
When should you reassess residual risk?
Reassess it when you have information about control completion and effectiveness. Apply your organization’s method and retain evidence supporting the new level. A passed deadline does not demonstrate that a control works.
Does an exemption replace the treatment plan?
No. An exemption sets conditions for a temporary deviation, including justification and a deadline. Treatment and control follow-up remain necessary; preparing an exemption requires organization-administrator access.
Explore more questions about vendors, risk and compliance.