The Definitive Governance Requirement.
Clause 8.3 mandates that you implement the information security risk treatment plan. This is the execution phase. In Clause 6.1.3, you planned how to fix your risks. In Clause 8.3, you must prove that you actually did it.
Shutterstock
The Mandate
There is a critical distinction between Planning (6.1.3) and Doing (8.3).
- Clause 6.1.3 says: “We will install Antivirus to mitigate the risk of malware.”
- Clause 8.3 says: “Here is the invoice for the Antivirus, and here is the screenshot showing it running on all 500 endpoints.”
The standard requires you to execute the Risk Treatment Plan (RTP). You must retain documented information of the results of this risk treatment. If you have a plan but no evidence of action, you are not managing risk; you are admiring it.
The Implementation Strategy
The implementation of risk treatment is a project management discipline. You are moving from “Analysis” to “Remediation.”
- Execute the RTP: Work through your Risk Treatment Plan line by line. If you assigned “Risk #24: Unpatched Servers” to the IT Manager with a due date of July 1st, ensure it is done by July 1st.
- Verify the Control: Just because you bought a tool doesn’t mean the risk is treated. Verify the configuration. Is the firewall actually blocking traffic? Is the MFA actually enforced?
- Update the Risk Register: Once the treatment is complete, go back to the Risk Register. Update the “Current Controls” and re-score the Residual Risk. The risk score should drop.
- Retain the Artifacts: Keep the “Before and After” evidence. This is your proof of improvement.
The Auditor’s Trap
[The Auditor’s View] The most common Major Non-Conformance here is “The Drift.” I often see a Risk Treatment Plan where every due date is “Overdue” by six months. The organization identified the risk, promised to fix it, and then got distracted. If you do not execute the plan you wrote, you are failing Clause 8.3. An overdue risk is an accepted risk that hasn’t been signed off.
Required Evidence
An auditor looks for the “Receipts” of remediation.
- Updated Risk Treatment Plan: Showing status changes from “Open” to “Closed.”
- Implementation Evidence: Technical logs, screenshots, invoices, or policy updates proving the control was deployed.
- Updated Risk Register: Showing the reduction in risk scores post-treatment.
- Statement of Applicability (SoA): Updated if the treatment required new controls.
Strategic Acceleration
Tracking the remediation of dozens of risks across different departments is a logistical nightmare without a centralized tracker.
The Hightable™ Risk Treatment Tracker links your RTP directly to your evidence folders. It ensures that when you mark a risk as “Closed,” the audit trail is automatically generated.
The Next Move: Deploy the Treatment Tracker