Treatment actions

A treatment action is one concrete piece of work that treats a risk. Examples: roll out MFA, move backups to immutable storage, segment the office network. An action has an owner role, a status, and a due date. One action can treat several risks, a vendor, or an incident.

A treatment action is not an integration action. An integration action is an automation rule that creates tickets in another tool. A risk's Actions tab shows integration actions.

Each action gets an ID: RTA-001, RTA-002, and so on.

Plan an action

1. Open Risks → Treatment Actions and select Add treatment action.
2. Name the action after the result, for example "Move backups to immutable storage".
3. Choose the owner role and describe the work.
4. Set the status to Planned and enter a due date. Save.
5. Open the risk that the action treats, select Edit, and link the action under Treatment.

The owner role gets a notification when an action is assigned to it and when its status changes.

Close an action

1. Open the action. Set its status to In Progress while the work runs, and to Implemented when it is done. Mark an action that no longer applies as Outdated or Deprecated.
2. Go back to the risk and set its residual ratings to where the risk now stands.

An open action with a due date appears on Deadlines. Open means: not archived, and its status is neither Implemented nor Deprecated. When the due date has passed and the status is still Unknown, Planned, or In Progress, the risk overview lists the action under Treatment actions overdue. Implementing the action or moving its due date clears both.

Reference

Fields

The action's pages

The list searches by name or ID and filters by Owner, Status, and Archived. The detail page shows the fields and the Related Data: the risks and incidents that the action treats. It also shows the Controls that the action implements; you link them there. Its tabs are Detail, Tasks, Comments, and History.

Where actions count

• The statistics strip of the matrix counts actions by status.
• The overview shows Treatment decided, no actions planned for a risk with no linked action, when its treatment is Mitigate, Transfer, or Avoid and its level is not acceptable.
• A vendor's current rating moves from its inherent toward its residual rating by the share of its linked actions that are implemented.

Import and export

The list's menu offers Import CSV, Download CSV template, and the exports. The template's columns are slug, name, ownerId, description, dueDate, and status.

• ownerId takes the role's name or id.
• dueDate takes 2026-12-31 or 31.12.2026.
• status takes the value or the label in your language.

Delimiters, encodings, and refused rows work as for risks.

name;ownerId;status;dueDate
Move backups to immutable storage;IT Operations;Planned;31.03.2027
Enforce phishing-resistant MFA for administrators;Security Engineering;In progress;2027-01-31

Limits and permissions

The free plan holds 10 treatment actions. The business plans have no limit. Owners, admins, and organization tokens create, edit, archive, and delete actions. Members and auditors can only read.

Watch out: deleting an action that an incident links to fails with an error. Remove the action from the incident first, or archive the action instead.

API

You link an action to a risk through the risk: riskTreatments on POST /risks/ or PATCH /risks/{id}/. The AI assistant lists actions with listTreatmentActions.