ISO 27001- Risk Treatment
As an organisation moves into the 'Do' Phase, it begins to formulate a risk treatment plan and starts to implement a number of controls identified during the Plan Phase. These controls could be technical eg anti virus or management eg security policies and processes. The risk assessment will identify the key threats and thus assist organisations to prioritise control implementation. In URM’s opinion it is important that organisations acknowledge that ISO 27001 is about continuous improvement and that they implement the controls in the highest risk areas first and do not try and do everything at once. Again the key word is sustainability.
One of the absolute must activities in this phase though is the implementation of a security awareness and training programme. URM is one of the UK's leading training providers in the areas of information security and governance, business continuity, risk management and data protection.
Back to lifecycle overview
