ISO 27005:2022 8.3: Determining all controls that are necessary to implement the information security risk treatment options

Input: prioritised risks with chosen options. Action: determine every control, from control sets chosen from suitable sources, needed to treat the risks under the chosen options (modify, retain, avoid, share). Trigger: ISMS conformity and managing information security risk. Output: all necessary controls. Each control is tested for necessity by asking what it does to the risk's likelihood or consequence and how it holds the risk level, and only controls with more than negligible effect count as necessary; every risk needing treatment gets at least one. Sources include 27001 Annex A, sector codes such as ISO/IEC 27017, other national, regional or industry sets, and custom controls (ISO/IEC 27003), whose wording should give a fair account of the control's nature and its operation, covering as relevant whether it is documented, its owner, monitoring, evidence, exceptions, frequency, tolerance and, if not obvious, why it exists; a control outside tolerance is not managing the risk well enough, and wording must above all mean something to the people who run it. Controls already operating are not included automatically: they may be unnecessary, too weak to count, operating for non-security reasons (quality, efficiency, compliance), or removable because their effect is too small. Dual-purpose controls (CCTV for production quality and fraud) are managed for both aims. Catalogue wording is matched to what the risk needs, with a custom control where the set has no accurate fit. Controls are classed as preventive, detective or corrective so plans stay resilient to control failure: detection covers failed prevention, correction covers failed detection, and prevention reduces the need for correction; detection is decided first, since undetectable events leave prevention unverifiable, detective controls can be bypassed or ignored, and corrective ones such as disk encryption or backup must be in place before the event, the category depending on how the event is framed. Risk owners balance control cost against consequence; redundant controls are removed only after cost-benefit analysis because controls interact; controls unrelated to managing an identified risk or operating for non-security reasons are left out; and weak controls whose risks are all within acceptance need no improvement, each control having a tolerance below which it counts as ineffective.