IT risk management is the fundamental basis for the decision - making process relating to the implementation and use of technology initiatives at the organizations, especially for telecommunications companies. Those companies provide support services to the customers by call - centers, they are exposed to Government regulations and they have IT Risk from their infrastructure. This paper presents guidelines for security manager to establish treatment alternatives.