The action chosen for each identified risk: avoid, mitigate, transfer, or accept.
Risk Treatment is the selection and implementation of one of four responses to identified risk: avoid (eliminate the activity), mitigate (apply controls to reduce likelihood/impact), transfer (insurance, contractual indemnity), or accept (formally retain the residual risk).
Run a free ComplianceIQ audit against ISO 27001 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.