What needs to be decided prior to considering the treatment of risks?

According to the information security risk management process defined in ISO/IEC 27001, an organization must first establish its risk criteria, which includes the criteria for risk acceptance. These criteria define the level of risk the organization is willing to tolerate. Only after a risk has been identified, analyzed, and evaluated against these pre-defined acceptance criteria can a decision be made on whether treatment is necessary. This foundational step ensures that decisions about risk treatment are consistent, objective, and aligned with the organization's strategic goals and risk appetite. Without these criteria, there is no basis for making informed decisions on how to handle identified risks.

B. How to apply appropriate controls to reduce the risks: This is a part of the risk treatment phase itself, which occurs after it has been decided that a risk is unacceptable.
C. Mitigation plans: These are specific outcomes of the risk treatment process. Developing them is a form of treatment, not a prerequisite for considering it.
D. The development of own guidelines: While important for the overall framework, establishing specific risk acceptance criteria is the direct, necessary input for the treatment decision.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 6.1.2 (Information security risk assessment): This clause mandates that the organization shall "establish and maintain information security risk criteria that include: 1) the risk acceptance criteria...". This step is part of the risk assessment process, which precedes the risk treatment process.

Clause 6.1.3 (Information security risk treatment): This clause details the process of selecting and implementing risk treatment options, which is performed based on the results of the risk assessment. This confirms that criteria must be established before treatment is considered.

2. ISO/IEC 27005:2022 - Guidance on managing information security risks.

Clause 7.2 (Risk criteria): This section details the establishment of criteria for performing risk evaluation and for accepting risks. It states, "The organization should define criteria for evaluating the significance of risks and for supporting decision-making processes."

Clause 8.2 (Risk evaluation): This clause explains that the purpose of risk evaluation is to "support decisions" by "comparing the results of risk analysis with the risk criteria established in 7.2, in order to determine where additional action is needed." This explicitly places the establishment of criteria before the decision on treatment (additional action).