Assign topic to the user
You need to gather information to evidence that actions taken to treat the risk were performed according to the decision made, and that expected results were achieved.
For example, in case you have a data loss risk and the decision is to treat the risk by including that data in a backup routine, then you need to evidence the backup schedule covering the related data, and the results of performed backup to show that the data as indeed backed up.
This article will provide you with further explanation about risk treatment:
- Risk treatment https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#treatment
Comment as guest or Sign in
May 27, 2022

