Most compliance tools optimize for the first certificate. The expensive part is the years after: spreadsheet sprawl, evidence reassembled from memory, controls nobody has looked at since the last cycle. Maintenance deserves to be the default, not the afterthought.
Every compliance tool is very good at one thing: getting you to your first certificate. Then the certificate arrives, the project team moves on, and the real work begins. That part rarely makes it into a demo.
Maintenance is the hard part of running an ISMS. Three habits make it tractable, and they change what a surveillance audit feels like: readiness becomes a state you keep rather than a sprint you survive. ISO 27001 is the running example here; the pattern holds for SOC 2 and GDPR too.
Carry an ISMS through more than one surveillance cycle and the same three pains come up, every time:
None of these are failures of intent. They are what happens when a management system is assembled for a moment instead of maintained as a practice. The certification project ends, the habits end with it, and twelve months later the audit date turns into a reconstruction job. If your evidence exists only in the week before an audit, you don't have an ISMS; you have a performance of one.
The shift that makes surveillance audits boring is to stop assembling readiness and start letting the system hold it. Three habits, in order of impact:
Don't let evidence collection become a quarterly project. If a human has to remember to gather it, it will rot between cycles. Attach capture to events that already happen: a release, a review, an access change.
The same surveillance audit, run two ways:
| The sprint | The state |
|---|---|
| Evidence hunted down in the last two weeks | Evidence attached as the work ships |
| Policies updated the night before | Policies versioned and linked to controls |
| Management review written from memory | Review maintained across the year |
| Findings surprise everyone | Findings tracked to closure as they appear |
The difference between the columns isn't effort. Over a full cycle the sprint usually costs more hours, and it spends them at the worst possible time, under deadline and from memory. The difference is when the effort happens and whether the system holds the result.
You don't need a particular tool to adopt the state model, and it would be dishonest to claim otherwise. Teams run it on disciplined wikis and well-kept registers. What you need is a place where three links survive personnel changes: control to evidence, control to policy, and finding to follow-up.
That third link is the one most setups lose. An internal audit that produces findings nobody tracks to closure is a ritual, not a control. When the finding, its corrective measure, and its deadline live next to the control they belong to, closing them becomes ordinary work instead of archaeology.
Attach capture to events that already exist in your pipeline and your calendar. A merge, a quarterly access review, a vendor renewal, a restore test — each produces an artifact at a moment when someone still knows what it means and why it was done. Recording it then costs a minute. Reconstructing it eleven months later costs an afternoon and produces a weaker artifact, because the context is gone.
The mechanism matters less than the trigger. A CI step that files the output, a checklist item ending in "link this to the control it evidences," a calendar entry that owns the review — each of these works. Intending to collect it later does not.
This is also where a system pays for itself across frameworks. If your controls are the anchor, adding SOC 2 next to ISO 27001 mostly means pointing a second framework at evidence you already maintain, not starting a second binder. For a team holding a certificate they intend to keep, that compounding is the whole point:
| Framework | Mapped | Coverage | Trend |
|---|---|---|---|
| ISO/IEC 27001 | 66 / 93 | 71% | ▲ +4 |
| SOC 2 | 41 / 64 | 64% | ▲ +2 |
| GDPR | 28 / 34 | 82% | — 0 |
When readiness is a state, the surveillance audit changes character. There is no archaeology: the evidence is already there, already mapped. The auditor asks for a control and you open it.
A tool doesn't remove the work; it holds the state, so the effort is spread across the year instead of compressed into one week.
Angelo runs strategy and the relationships behind devguard. He spends his time with the teams who live with compliance day to day, and keeps what we build tied to what they actually need.
Start free, bring your frameworks, and keep the evidence attached as the work ships — no setup friction, no audit-week fire drill.
Start free, bring your frameworks, and keep the evidence attached as the work ships — no setup friction, no audit-week fire drill.