You can maintain ISO 27001 between audits without a full-time GRC hire by running the ISMS as a set of scheduled recurring tasks, using a platform to automate evidence collection, and bringing in fractional expertise such as a virtual CISO for the judgement work. The trap is treating certification as a finish line, when the standard expects the system to keep operating.
Certification is the start, not the finish
Many organisations pour effort into achieving ISO 27001, celebrate the certificate, and then let the ISMS go quiet. That is the most expensive mistake in the whole lifecycle, because certification is not a one-time event. The standard expects the information security management system to keep operating, and surveillance audits in years one and two exist specifically to check that it has.
The good news is that maintaining ISO 27001 does not require a dedicated, full-time governance, risk and compliance hire, which many small and mid-sized organisations cannot justify. It requires a system for keeping the system running.
What maintenance actually involves
Between audits, an ISMS needs a handful of recurring activities kept alive:
- Regular access reviews and control checks
- Ongoing risk management, updating the risk assessment as things change
- Collecting and organising evidence continuously, not the week before an audit
- Managing incidents and improvements through the ISMS
- Running the internal audit and management review each cycle
- Reviewing supplier and third-party risk
None of these is enormous on its own. The problem is that when no one owns them, they quietly lapse, and a lapsed ISMS is exactly what a surveillance auditor finds.
Turn maintenance into a schedule
The single most effective move is to convert maintenance into a calendar of recurring tasks with clear owners. Quarterly access reviews. A monthly evidence check. An annual internal audit and management review, scheduled well ahead. When each activity has a date and an owner, maintenance becomes routine rather than a scramble, and it does not depend on one person remembering everything.
This is how organisations without a GRC team stay certified. They do not do more work, they do the work on a rhythm, so nothing builds into a crisis before the audit.
Use a platform for the repetitive parts
A compliance platform earns its place in maintenance, because the most tedious part is continuous evidence collection. Automating that keeps you audit-ready on the technical controls without manual effort, and flags drift as it happens. For a lean team, that automation is the difference between maintenance being sustainable and being a burden.
The caveat is the familiar one: a platform handles the collection and monitoring, not the judgement. It will not run your risk review, conduct your internal audit, or decide how to treat a new risk. Those still need a person.
Bring in fractional expertise
This is where a virtual CISO or fractional GRC support fits, and why a full-time hire is often unnecessary. The judgement work of maintaining an ISMS, the risk reviews, the internal audit, the management review, the audit preparation, is periodic, not constant. Paying for it as an ongoing full-time role is more than most organisations need.
A virtual CISO provides that expertise on the cadence the ISMS actually requires. They run the periodic activities, keep the system healthy, and make sure you walk into each surveillance audit prepared, without the cost of a permanent hire. For many organisations this is the most cost-effective way to stay certified.
The model that works
Put together, the model is simple: a scheduled rhythm of recurring tasks, a platform to automate the evidence grind, and fractional expertise for the judgement and the audits. That combination maintains ISO 27001 reliably without a full-time GRC salary, and it scales as you grow.
If you want your ISMS maintained without a permanent hire, our virtual CISO services provide the periodic expertise and audit preparation, and a security risk assessment keeps your risk picture current between cycles.
For the standard, see the official ISO/IEC 27001 page.
Frequently asked questions
Do you need a full-time GRC hire to maintain ISO 27001?
No. Most small and mid-sized organisations can maintain ISO 27001 with a scheduled rhythm of recurring tasks, a platform to automate evidence collection, and fractional expertise such as a virtual CISO for the periodic judgement work, rather than a permanent full-time role.
What does maintaining ISO 27001 involve?
Regular access reviews and control checks, ongoing risk management, continuous evidence collection, incident and improvement management, and the annual internal audit and management review, plus supplier risk reviews. These are modest tasks that lapse when no one owns them.
What do surveillance audits check?
Surveillance audits in years one and two check that the ISMS has continued operating since certification, not just that it existed on audit day. They look for evidence that controls, reviews and improvements have run throughout the year.
How does a virtual CISO help with maintenance?
A virtual CISO provides the periodic judgement work, risk reviews, internal audit, management review and audit preparation, on the cadence the ISMS needs, without the cost of a full-time hire. It suits organisations that need expertise regularly but not constantly.
