<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-risk-treatment-planning
description: >-
  Develop and execute risk treatment plans addressing identified risks through mitigation, transfer, acceptance, or avoidance.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - risk-treatment
  - risk-management
  - controls
  - residual-risk
  - risk-mitigation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Risk Treatment Planning

## Overview

Risk treatment planning converts risk assessment findings into actionable
plans. For each identified risk, the organization selects a treatment option,
implements appropriate controls, calculates residual risk, and tracks progress.

## Prerequisites

| Requirement | Install |
|---|---|
| Risk assessment results | Completed risk register |
| Control catalog | Available controls mapped to risk types |
| Risk appetite statement | Risk tolerance thresholds |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Treatment Options

| Option | Description | When to Use |
|---|---|---|
| Mitigate | Implement controls to reduce risk | Risk exceeds appetite, controls cost-effective |
| Transfer | Shift to third party (insurance) | Cannot be mitigated internally |
| Accept | Acknowledge without additional controls | Within appetite, cost exceeds benefit |
| Avoid | Eliminate the activity | Cannot be mitigated |

### Residual Risk

Residual risk = Inherent risk - Control effectiveness

After treatment, residual risk must fall within appetite:
- **Within appetite** — Accept and monitor
- **Above appetite** — Additional treatment required
- **Requires exception** — Escalate to risk committee

### Treatment Plan Components

1. **Risk ID** — Reference to risk register entry
2. **Treatment option** — Mitigate, transfer, accept, or avoid
3. **Controls selected** — Specific controls to implement
4. **Risk owner** — Accountable individual
5. **Timeline** — Start and target completion dates
6. **Residual risk** — Expected level after treatment

## Workflow

1. **Review risk register** — prioritize risks by severity and impact
2. **Select treatment options** — choose mitigate, transfer, accept, or avoid
3. **Identify controls** — map controls to selected treatments
4. **Calculate residual risk** — estimate risk after control implementation
5. **Assign risk owners** — designate accountable individuals per risk
6. **Create treatment timeline** — schedule implementation with milestones
7. **Track and report** — monitor progress and effectiveness


## Verification

| Check | Method |
|---|---|
| Treatments selected | All high/critical risks have assigned treatment |
| Controls identified | Specific controls mapped to each mitigated risk |
| Residual risk calculated | Post-treatment risk levels documented |
| Owners assigned | Every risk has a designated owner |
| Progress tracked | Treatment plans updated at least monthly |

## References

- [ISO 27005:2022](https://www.iso.org/standard/80585.html)
- [NIST SP 800-37](https://csrc.nist.gov/pubs/sp/800/37/r2/final)
- [NIST SP 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)
- [FAIR](https://www.fairinstitute.org/)
