In brief
An ISO/IEC 27001 certificate is valid for three years with annual surveillance audits, so the system must be maintained continuously. We run maintenance in an annual cycle; a vCISO is ongoing information security leadership on a subscription basis – without hiring a CISO. Formal decisions remain with your management.
How does the annual maintenance cycle for a certified ISMS work?
| Period | Activities |
|---|---|
| Months 1–3 | corrective actions following the last audit |
| Months 4–6 | risk reassessment and update of the Statement of Applicability (SoA) |
| Months 7–9 | staff training and internal audit |
| Months 10–12 | information security objectives, management review and surveillance audit |
Which maintenance scope should you choose?
| Service | System maintenance | Maintenance with advisory support |
|---|---|---|
| Internal ISMS audit with a report and proposed corrective actions (9.2) | once a year | once a year |
| Inputs to and minutes of the management review (9.3) | once a year | once a year |
| Preparation for the surveillance or recertification audit, participation in the audit and response report | included | included |
| Risk assessment and update of the risk register, risk treatment plan and Statement of Applicability (6.1.2, 6.1.3, 8.2) | once a year | once a year and after significant changes |
| Maintenance of ISMS documentation when processes, systems and legislation change (7.5) | included | included |
| Staff training and awareness (7.2, 7.3) | once a year | twice a year |
| Monitoring of information security objectives and indicators (6.2, 9.1) | once a year | quarterly |
| Updates on changes to legislation and standards | included | included |
| Supplier security review (Annex A, 5.19–5.22) | – | once a year |
| Quarterly ISMS status review with management | – | included |
| Advisory support: security events and incidents, new services and systems, customer security questionnaires | – | agreed number of hours per month |
| Support with NIS2 obligations (for entities in scope): risk management measures, incident reporting procedures, training of responsible persons | – | included |
The internal audit is carried out by an auditor who was not involved in preparing and maintaining the documentation, which ensures the objectivity and impartiality of the audit (clause 9.2.2 of the standard).
What is a vCISO and when is it worth it?
A vCISO is ongoing information security leadership on a subscription basis: regular reviews, registers, reporting to management and preparation for audits and supervision – without hiring a CISO. It pays off when you need continuity and demonstrable compliance all year round.
4–6 hours a month
Basic system leadership and reporting to management.
8–12 hours a month
Regular programme leadership and regular reporting to management.
16+ hours a month
Higher complexity, including IT/OT environments, and preparation for audits and supervision.
What do we do in the first 30 days?
Initial asset and risk register
Review of key systems, data and suppliers and the biggest risks.
Review of evidence
What already exists, what is missing and what an auditor or supervisor would ask for.
Prioritised action plan
Measures with owners and deadlines, agreed with management.
Reporting to management
An agreed format and frequency for reporting on status and risks.
Frequently asked questions about vCISO and maintenance
What is the difference between a vCISO and consulting?
A vCISO is an ongoing subscription model: leading the information security programme, regular reviews, registers, tasks, reports to management and a record of approvals. Consulting is usually one-off or project-based. A vCISO provides continuity and demonstrable compliance all year round.
Does a vCISO take over accountability from management?
No. The vCISO leads implementation and prepares proposals for policies, measures and reports, but formal decisions – adopting policies, accepting residual risks, thresholds in the business impact analysis and approving reports – are taken by the organisation's management.
How quickly can we start?
We start with a scope assessment (type of entity, sector, scope) and a plan for the first 30 days: initial asset and risk register, review of evidence, a prioritised action plan and set-up of reporting to management.
Who carries out the internal audit if you maintain the system?
The internal audit is carried out by an auditor who was not involved in preparing the documentation (clause 9.2.2 of the standard). This keeps the audit objective even if we maintain the system.
Sources
- ISO/IEC 27001:2022 – Information security management systems – Requirements (ISO)
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
Last updated: · Prepared by the Regulus Ai team
Would you like a proposed scope for maintenance or a vCISO?
Book an initial consultation