ISO 27001 Risk Treatment Plan Template

What is in this template

Eleven columns, three worked example rows you can delete, and dropdowns that suggest values for risk level, treatment decision and status. The columns:

• ✓Risk ID — matching your risk assessment exactly
• ✓Risk summary and inherent risk (High / Medium / Low)
• ✓Treatment decision dropdown: Treat / Avoid / Transfer / Accept
• ✓Annex A control(s) selected — the link to your Statement of Applicability
• ✓Action to be taken, owner and target date
• ✓Residual risk — where you expect to land after treatment
• ✓Optional status dropdown and evidence column — where the proof lives once the action is done

The About tab explains the four treatment decisions and how the plan connects to your risk assessment and Statement of Applicability.

How to use it

1. 1

   Start from your risk assessment

   Copy across every risk you have decided to treat, avoid or transfer, keeping the same Risk ID. Accepted risks can go in too: record who accepted each one, on what basis and when it will be revisited.

2. 2

   Record the decision and the controls

   Pick the treatment decision, then name the Annex A controls you are relying on. Those controls should be marked applicable in your Statement of Applicability.

3. 3

   Make each action specific

   A named owner and a date for every action. "IT to review access" is not an action; "Ops Manager runs a quarterly access review against the HR leaver list" is.

4. 4

   Record the residual risk

   Where you expect each risk to land after treatment, and whether that level is acceptable.

5. 5

   Keep it alive

   Update the optional status and evidence columns as work completes, and review the plan alongside your risk assessment and at management review.

Where the structure comes from

The UK National Cyber Security Centre describes a cyber security risk management plan as one that “sets out how cyber security risks will be managed and describes those controls that will be implemented to treat identified risks”. This template gives that plan a row structure an auditor can trace from risk to control to evidence.

The text of ISO/IEC 27001 is not publicly available and is not reproduced here. The template is a structure for recording your own decisions — confirm what your certification body expects with your UKAS-accredited certification body. Last verified: 9 November 2026.

Related guides