Managing Risk Treatment Plans

Creating a Risk Treatment Plan

Follow these steps to create a new Risk Treatment Plan.

1. From the left navigation menu, navigate to Projects > Risk Treatment Plan. This page serves as the central location for managing all Risk Treatment Plans.

2. Click the + button to create a Risk Treatment Plan.
   

3. Select the Group for which you want to create the treatment plan.

4. Click the What-If Analysis button.
   

5. Scroll down to the Controls/Findings section.

6. Filter and select the controls or findings for which you want to perform the What-If Analysis.

7. Update the Target Control Maturity or Finding Status based on your remediation objectives.

8. Review the projected risk reduction. SAFE automatically recalculates the projected impact of your proposed changes.
   

9. Review the updated values for:

   • Likelihood

   • Loss Magnitude

   • Annual Loss Expectancy (ALE)

10. Continue adjusting the target values until you achieve the desired level of risk reduction.

11. Click Save as a Treatment Plan.

12. Enter a name for the treatment plan.

13. Click Create.

14. SAFE redirects you to the Treatment Plan Details page.

15. Click Edit and populate the remaining plan information:

    1. Treatment Type

    2. Priority

    3. Owner Email

    4. Assignee Email

    5. Start Date

    6. End Date

    7. Rationale

16. Click Save to finalize the Risk Treatment Plan.

Managing Risk Treatment Plans

Once a Risk Treatment Plan has been created, SAFE CTEM provides a centralized interface to manage, monitor, and update its lifecycle. This enables security teams to track remediation progress, maintain accountability, and ensure treatment activities remain aligned with organizational objectives.

View Risk Treatment Plans

1. Navigate to Projects > Risk Treatment Plan. The Risk Treatment page displays all treatment plans created within the selected group, along with key information such as:

   1. Treatment Plan Name

   2. Treatment Type

   3. Priority

   4. Owner

   5. Assignee

   6. Current Status

   7. Planned Start and End Dates

   8. Risk Reduction Progress

Edit a Risk Treatment Plan

To update an existing treatment plan:

1. Navigate to Risk Treatment plan

2. Select the treatment plan you want to update.

3. Click Edit.

   1. Modify the required fields, such as:

   2. Treatment Type

   3. Priority

   4. Owner Email

   5. Assignee Email

   6. Start Date

   7. End Date

   8. Rationale

4. Click Save to apply your changes.

Notes

• Updating treatment plan details does not modify the original What-If Analysis. To change the projected risk reduction, create a new What-If Analysis and save it as a new Treatment Plan.

• To delete or complete a Risk Treatment Plan, click the three-dot (More Actions) menu in the Manage column of the Risk Treatment Plan list. Select Delete to permanently delete the Risk Treatment Plan.

• Select Mark as Completed to mark the Risk Treatment Plan as completed once all remediation activities have been finished.