An ISMS is only as good as its upkeep. In an audit, "we have an information security policy" is not enough. The auditor wants to see three things: the policy is reviewed on a regular basis (usually once a year), updated when needed, and confirmed by top management. The same goes for about 20 other asset classes, such as controls, procedures, risks, suppliers, and BCDR plans.
The Unsolved Problem in Many Companies
Reviews slip because:
- There is no central calendar for "what needs a review, and when".
- Reminders through Excel and Outlook meetings only half work, and people ignore them.
- Owners change, and reviews are left without anyone in charge.
- Nobody has defined what happens when a review is missed.
The auditor will notice this at the latest when they ask for the "last review date" of all 80 policies as a CSV. Then 30 % of them turn out to be > 12 months old.
What Integrated Review Cycle Management Delivers
- Schedules by interval: you set the interval per asset, control, or policy (monthly, quarterly, yearly, or every X).
- Reminders on many channels: mail, Slack webhook, Teams webhook, and an optional push message in the web app. You can adjust the reminder plan, for example 30, 14, 7, and 1 days before the due date.
- Smart escalation: if a review is missed, the system escalates step by step. First the deputy owner, then the ISMS manager, then top management. No more "asking nicely" until the audit.
- Approval workflow: an optional four-eyes approval when a review is done. This matters for high-risk assets, such as the crypto key lifecycle or supplier security checks.
- Dashboard and reports: a live "% on-time reviews" metric, the trend, and the workload for each owner. Plus an export button for the auditor.
Which Items Are Covered
By default: assets, controls, policies, risks, suppliers and vendors, BCDR plans, procedures, documents, findings, and audits. Each tenant can adjust this. If you want to track one more class (such as "key material"), you get your own review type. It has its own interval and its own pool of owners.
Compliance Mapping
ISO 27001 clearly requires regular reviews (Cl. 9.1, A.5.36, A.8.34, etc.). NIS-2 requires that you keep checking your measures (Art. 21(3)). GDPR Art. 32 calls for regular checks on how well the TOMs work. Good review cycle management covers all three in one workflow.
Realistic Setup Effort
Plan for this setup time:
- three hours to set up the intervals,
- one hour to define the escalation rules,
- two hours to assign owners.
From then on, there are no more manual reminders. ISMS upkeep shifts from "chasing people" to "reviewing the content".
Conclusion
Review cycle management is the link between "ISMS built" and "ISMS alive". A platform with interval scheduling, reminders on many channels, escalation, and reports fully replaces Excel trackers and Outlook reminders. It turns that dreaded "reviews are due again" feeling each quarter into a steady process you can plan.