Planning: Risk Assessment & Treatment (Clause 6)

Clause 6 is where the vocabulary from lesson 1 (asset, threat, vulnerability, risk) turns into a repeatable process with actual outputs. This is the clause auditors probe hardest, because a weak risk assessment undermines everything built on top of it — including your entire Annex A control selection.

6.1.2: Risk assessment — four steps

1. Establish and apply risk criteria

Before assessing anything, you decide how you'll judge risk. This means defining:
- A risk acceptance criteria (what level of risk is tolerable — e.g., "any risk scoring above 12 on our 5×5 matrix requires treatment")
- Criteria for performing assessments (consistency requirement — the same kind of risk should be scored the same way regardless of who assesses it)

Skipping this step is a common Foundation-level mistake: jumping straight to "what could go wrong?" without first defining what "too risky" even means for your organization produces inconsistent, unauditable results.

2. Identify risks

Systematically identify risks to the confidentiality, integrity, and availability of information within the ISMS scope. In practice this usually means walking through your information assets (or your critical business processes) and asking, for each: what could threaten it, and through what vulnerability?

3. Analyze risks

For each identified risk, assess:
- Likelihood — how probable is this, realistically, given your existing controls?
- Impact / consequence — how bad would it be if it happened?

Most organizations use a simple matrix:

              Impact →
         Low    Medium   High
Likelihood
  Low      1       2       3
  Medium   2       4       6
  High     3       6       9

A risk scoring 9 (high likelihood × high impact) clearly needs attention before one scoring 1 — the point of analysis is to make prioritization defensible with numbers, not gut feeling alone.

4. Evaluate risks

Compare the analyzed risk level against the acceptance criteria from step 1, and prioritize which risks need treatment. Risks below the acceptance threshold can be knowingly accepted (see below) — that is a legitimate outcome, not a failure to act.

6.1.3: Risk treatment — four options

Once you know which risks need treatment, you choose one (or a combination) of four standard responses:

Whichever options you choose, residual risk remains — no treatment reduces risk to zero. Clause 6.1.3 explicitly requires obtaining risk owners' approval of the risk treatment plan and their acceptance of residual risk. This is not a technicality: someone with real authority has to knowingly sign off that "yes, this remaining risk is acceptable to the organization," rather than it being silently assumed.

The bridge to Annex A: the Statement of Applicability

Clause 6.1.3 is also where the Statement of Applicability (SoA) is introduced — it's the document that records, for every one of the 93 Annex A controls, whether it's included or excluded, and why, linked back to your risk treatment decisions. A later lesson covers building an SoA in depth; for now, the key point is that the SoA isn't a separate creative exercise — it's the direct output of the risk treatment decisions made here in clause 6.

6.2: Information security objectives

Clause 6.2 requires setting measurable security objectives, consistent with the policy from clause 5. A weak objective is vague: "improve security awareness." A strong objective is SMART — Specific, Measurable, Achievable, Relevant, Time-bound: "95% of staff complete phishing awareness training by the end of Q2, verified via the training platform's completion report." Auditors will ask to see the measurement evidence, not just the objective statement.