ISO 27001 Clause 8.3 — Information security risk treatment
Implementing the treatment plan — the shortest clause in the standard and the one an auditor tests most directly
Clause 8.3 requires the organisation to implement the information security risk treatment plan and to retain documented information of the results of risk treatment. Two sentences, and between them they decide whether the ISMS is real.
📌 Quick navigation
What the clause asks for
The plan itself was formulated under clause 6.1.3 e) and approved by the risk owners under 6.1.3 f). Clause 8.3 is the requirement that it is carried out.
“Results” means the outcome, not the activity. What was implemented, when, what the residual risk is now, and what evidence supports that claim.
This is the most directly testable clause in the standard. An auditor takes the treatment plan, picks a line, and asks to see it working. Everything else in the ISMS can be documented; this one either happened or it did not.
What it looks like in practice
| Element | What it should show |
|---|---|
| The plan | Actions, owners, dates, and the risks each one addresses. |
| Implementation records | Evidence that each action was completed — configuration, tickets, contracts, training records, test results. |
| Results | What the residual risk is after treatment, and how you know. |
| Verification | Evidence the control works, not just that it exists: an access review actually performed, a restore actually tested. |
| Slippage handling | Where an action is late, a recorded reason and a decision — not a quietly revised date. |
| Residual risk acceptance | Risk owner acceptance, dated, revisited when the residual risk changes. |
The distinction that matters is between implemented and effective. A backup policy is implemented when the backups run; it is effective when a restore has been tested. Clause 8.3 asks for the results of treatment, and clause 9.1 asks you to evaluate effectiveness — but an auditor will look for both at once.
Treat a slipping action as information rather than as an embarrassment. A plan with honest dates and recorded reasons for change is stronger evidence of a working ISMS than a plan where every item is marked complete.
What an auditor will want to see
- The current risk treatment plan with owners and dates.
- Evidence of implementation for each completed action.
- Documented results of treatment, including residual risk.
- Verification that the implemented controls work.
- Records of risk owner acceptance of residual risk.
- A Statement of Applicability whose implementation status matches reality.
Where it usually goes wrong
| Pattern | Why it fails |
|---|---|
| The SoA out of step with reality | Controls marked implemented in the Statement of Applicability that are not. Found immediately, and it undermines everything else. |
| Plans that never complete | Dates revised repeatedly with no decision recorded. Usually a resourcing problem under clause 7.1, and it should be escalated as one. |
| Implementation without verification | A control put in place and never tested. Implemented is not the same as working. |
| Residual risk not revisited | Accepted once, at a level that has since changed, with no re-acceptance. |
| No results retained | The treatment happened and nothing records the outcome. The clause requires the results, not only the activity. |
Frequently asked questions
What counts as evidence of implementation?
Whatever shows the action was done and is working — configuration, tickets, contracts, test results, training records. It varies by control; the test is whether it would convince a sceptical reader.
What if we cannot complete an action?
Record why, reassess the risk, and have the risk owner decide: accept the higher residual risk, or resource the action. What is not acceptable is silence.
How does 8.3 differ from 6.1.3?
6.1.3 requires the treatment process and the plan. 8.3 requires the plan to be implemented and the results retained.
Do we need to retain evidence for every control?
You need enough to show the treatment was carried out and what the results were. Proportionate, not exhaustive — but thin enough evidence will be sampled and found wanting.
A treatment plan that moves is the single best sign of a healthy ISMS. If yours has stalled, contact us — and the Lead Implementer course covers how to plan one that can actually be delivered.
Where this sits
This page explains the requirement in our own words, for study and orientation. It is not a substitute for the standard: the authoritative text is ISO/IEC 27001:2022, available from ISO and from national standards bodies.
