Once you have completed the risk assessment, you can move on to the selection of controls, and this chapter reviews the requirements of ISO27001 around control selection, which is also known as ‘risk treatment’.
As we said in Chapter 1, there are four risk treatment decisions that can be made:
• accept the risk;
• eliminate the risk by work-around or other arrangements;
• control the risk to bring it to an acceptable level;
• transfer it to a third party (e.g. via insurance).
The criterion that is used in making the decision is simple: either the risk is within the risk tolerance level, in which case it is accepted, or it is not, in which case it must be avoided, controlled or transferred. ...