Editing Risk management (section)

===Risk management plan===
{{Main|Risk management plan}}

Select appropriate controls or countermeasures to mitigate each risk. Risk mitigation needs to be approved by the appropriate level of management. For instance, a risk concerning the image of the organization should have top management decision behind it whereas IT management would have the authority to decide on computer virus risks.

The risk management plan should propose applicable and effective security controls for managing the risks. For example, an observed high risk of computer viruses could be mitigated by acquiring and implementing antivirus software. A good risk management plan should contain a schedule for control implementation and responsible persons for those actions. There are four basic steps of risk management plan, which are threat assessment, vulnerability assessment, impact assessment and risk mitigation strategy development.<ref>{{Cite book |last=Snedaker |first=Susan |url=https://www.worldcat.org/oclc/858657442 |title=Business continuity and disaster recovery planning for IT professionals |date=2014 |publisher=Syngress |others=Chris Rima |isbn=978-1-299-85332-4 |edition=2nd |location=Waltham, MA |oclc=858657442}}</ref>

According to [[ISO/IEC 27001]], the stage immediately after completion of the [[risk assessment]] phase consists of preparing a Risk Treatment Plan, which should document the decisions about how each of the identified risks should be handled. Mitigation of risks often means selection of [[security controls]], which should be documented in a Statement of Applicability, which identifies which particular control objectives and controls from the 
standard have been selected, and why.