Control activities for mitigation of risks

When implementing information security risk management, the organisation must identify the risks that require treatment and define treatment plans for them, which often consist of new information security measures.

The organisation has defined how regularly the treatment plans defined as a whole are evaluated and their proportionality to the risk assessment (risk severity and probability).

Implemented risk management measures and the overall situation of risk management are checked regularly.

The operating model for monitoring the status of risk management is clearly described.

The organization must consider the risks for achieving information security goals. Risks related to the achievement of goals must be mitigated by setting up control measures in at least the following areas:

• Risk assessment process
• Organization-specific factors, such as the environment, nature, the structure of the organization and the scope of its activities
• Essential business processes

In the management of information security risks, the tasks must be separated if they are not compatible.

In a situation where the tasks are not compatible, but the separation of tasks is not practical, separate controls must be developed to monitor it.