GRC · Specialist service
ISMS maintenance and security documentation updates
An ISMS must keep pace with changes to systems, suppliers and working practices. We help keep documentation current and maintain the regular activities needed for the system to operate.
Service scope
ISMS maintenance
We provide recurring support for maintaining the agreed ISMS scope. We review documentation, risk registers and action plans in the context of organisational and technological changes and adopted requirements. We help process owners collect evidence and prepare review materials. We turn lessons from incidents, audits and exercises into concrete tasks. We establish a working cadence and change handling rules so updates go beyond editing documents.
Maintenance schedule
We organise the calendar of reviews, measurements and updates, assigning owners, required materials and escalation procedures for delays.
Documents and registers
We update agreed policies, procedures and registers. We manage versions and confirm who approves and communicates changes.
Risk and evidence
We support reassessment after changes, incidents and new findings. We help compile records demonstrating that processes are carried out.
Improvement and reviews
We combine audit recommendations, exercise findings and operational issues into an improvement plan. We prepare materials for owner and management decisions.
Project deliverables
What will your team receive?
- ISMS maintenance schedule with assigned responsibilities.
- Updated documents and change register.
- Summary of evidence and missing records.
- Progress report and improvement action plan.
Delivery conditions
What do we agree before starting?
- Implemented or agreed ISMS scope and its documentation.
- Process owners available for reviews and approvals.
- Information about changes, incidents, audits and measurement results.
How we work
From understanding the need to verifying the result.
Understand the context
We review the scope, documentation status and open tasks, and agree a working cadence and owner roles.
Conduct reviews
We analyse new changes and operational evidence, then prepare updates and materials for approval.
Track improvement
We track agreed tasks and assess results, escalating issues that require management decisions.
Clear responsibilities
What is already included, and what do we extend?
Maintaining the client’s ISMS is a separate GRC service. Updates to playbooks, our own service documentation and Enterprise operational reviews remain within the core package.
Before making a decision
Questions about ISMS maintenance
Does maintenance automatically include a vISM role?
No. We can agree a task-based review scope or separately assign the vISM coordination role. Its mandate and responsibilities should be defined in the agreement.
Which changes require an ISMS review?
Examples include a new service, a significant supplier, a reorganisation, a technology change or a serious incident. We assess their impact on scope, risks, procedures and controls.
Does recurring maintenance replace an internal audit?
No. Maintenance reviews support system operation. Internal audit is a separate assessment against a programme and criteria, with the required impartiality.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.