Risk treatment plan

The plan that says what you will do about each information security risk you have assessed, with owners and dates: modify it with controls, retain it, avoid it or share it. Clause 6.1.3 requires you to write the plan, have risk owners approve it and accept the residual risk; clause 8.3 requires you to carry it out and keep evidence. It is the bridge between the risk assessment and the Statement of Applicability.