Risk treatment is the process of selecting and implementing options to modify the identified risk level.
According to ISO 31000, risk treatment involves selecting one or more options to modify risks and implementing those options. The four fundamental options are: avoid the risk, modify likelihood or consequence, share the risk, or retain the risk informed.
Modifying risk through controls is the most frequent option. In information security, this translates to implementing ISO 27001 Annex A controls.
The decision to retain a risk must be approved by whoever has authority over that risk level, usually top management or the designated risk owner.
Need an assessment in this area?