Input: assessment results. Action: formulate the plan. Trigger: the need to treat risks. Output: the risk treatment plan. Plans treat sets of the prioritised risks so they meet the acceptance criteria of 6.4.2, either as a project plan for implementing controls (of historical value once done) or as a design plan showing how controls interact with each other and their environment (lasting value), or both. Every risk needing treatment is covered by some plan, and several plans may be organised by where information resides, by asset class or by event. Planning weighs priority by risk level and urgency, the right balance between preventive, detective and corrective controls, whether one control must settle before another is added on the same asset, and any lag before a control is fully effective. Each treated risk's plan states the rationale for the options and their expected benefits, who answers for approving it and who carries it out, the proposed actions, resources including contingencies, performance indicators, constraints, reporting and monitoring, the timing of actions and their implementation status. Actions are ranked by risk level and urgency, higher risks (and sometimes frequent ones) being addressed sooner, and implementation is tracked per risk with owners and implementers, dates or timelines, control tests of the result, status and cost level for investment and operation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.