Most compliance tools optimize for the first certificate. The expensive part is the years after: spreadsheet sprawl, evidence reassembled from memory, controls nobody has looked at since the last cycle. Maintenance deserves to be the default, not the afterthought.
Every compliance tool is very good at one thing: getting you to your first certificate. Then the certificate arrives, the project team moves on, and the real work begins. That part rarely makes it into a demo.
This post walks through why maintenance is the hard part of running an ISMS, the three habits that make it tractable, and what a surveillance audit looks like when readiness is a state you keep rather than a sprint you survive. It uses ISO 27001 as the running example, but the pattern holds for SOC 2 and GDPR too.
Talk to anyone who has carried an ISMS through more than one surveillance cycle and the same three pains come up, every time:
None of these are failures of intent. They are what happens when a management system is assembled for a moment instead of maintained as a practice. The certification project ends, the habits end with it, and twelve months later the audit date turns into a reconstruction job.
If your evidence only exists the week before an audit, you don't have an ISMS. You have a performance.
The shift that makes surveillance audits boring is to stop assembling readiness and start letting the system hold it. Three habits, in order of impact:
Don't let evidence collection become a quarterly project. If a human has to remember to gather it, it will rot between cycles. Attach capture to events that already happen: a release, a review, an access change.
The same surveillance audit, run two ways:
| The sprint | The state |
|---|---|
| Evidence hunted down in the last two weeks | Evidence attached as the work ships |
| Policies updated the night before | Policies versioned and linked to controls |
| Management review written from memory | Review maintained across the year |
| Findings surprise everyone | Findings tracked to closure as they appear |
The difference between the columns isn't effort. Over a full cycle the sprint usually costs more hours, and it spends them at the worst possible time, under deadline and from memory. The difference is when the effort happens and whether the system holds the result.
You don't need a particular tool to adopt the state model, and it would be dishonest to claim otherwise. Teams run it on disciplined wikis and well-kept registers. What you need is a place where three links survive personnel changes: control to evidence, control to policy, and finding to follow-up.
That third link is the one most setups lose. An internal audit that produces findings nobody tracks to closure is a ritual, not a control. When the finding, its corrective measure and its deadline live next to the control they belong to, closing them becomes ordinary work instead of archaeology.
Attach capture to events that already happen. A single step in CI records the proof and maps it to controls automatically:
# capture evidence on every merge to main$ devguard scan --attest --map iso27001→ 142 assets scanned · 0 critical✓ 34 artifacts linked to 18 controls✓ evidence pushed · ISO 27001 · SOC 2
This is also where a system pays for itself across frameworks. If your controls are the anchor, adding SOC 2 next to ISO 27001 mostly means pointing a second framework at evidence you already maintain, not starting a second binder. For a team holding a certificate they intend to keep, that compounding is the whole game:
| Framework | Mapped | Coverage | Trend |
|---|---|---|---|
| ISO/IEC 27001 | 66 / 93 | 71% | ▲ +4 |
| SOC 2 | 41 / 64 | 64% | ▲ +2 |
| GDPR | 28 / 34 | 82% | — 0 |
When readiness is a state, the surveillance audit changes character. There is no archaeology: the evidence is already there, already mapped. The auditor asks for a control and you open it.
Where the honesty matters: a tool doesn't remove the work — it holds the state so the work is spread across the year instead of compressed into one week.
Angelo runs strategy and the relationships behind devguard. He spends his time with the teams who live with compliance day to day, and keeps what we build tied to what they actually need.
Start free, bring your frameworks, and keep the evidence attached as the work ships — no setup friction, no audit-week fire drill.
Start free, bring your frameworks, and keep the evidence attached as the work ships — no setup friction, no audit-week fire drill.