Ongoing compliance - ISO 27001
A monthly retainer that runs the operational rhythm of your ISO 27001 information security management system: the risk register, the Statement of Applicability, the evidence schedule, corrective actions, internal audit coordination and management review.
For organisations with a certified ISMS, or one well on the way. It is management system upkeep, not executive security leadership - if you need senior ownership of security strategy and board reporting, that is our vCISO service.
Who it is for
Risks are reviewed once a year, the week before the audit, and no longer reflect the business.
Access reviews and restore tests were done for certification, then quietly stopped.
Corrective actions are recorded but nobody verifies they worked, so the same nonconformity returns.
Controls change in practice but the Statement of Applicability still describes last year.
Why an external specialist
How it works
In the first month we review the ISMS as it stands - scope, risk register, SoA, open actions, last audit report - and agree what the calendar must catch up on.
We set the monthly, quarterly and annual activities against your certification cycle and the capacity you have contracted.
Evidence checks, owner check-ins and corrective action follow-up each month, with a short written status.
Internal audit scheduled with an independent auditor, management review inputs prepared, surveillance readiness checked.
Each quarter we review whether the capacity still fits the system and say so if it does not.
Operating calendar
Sized to your certification cycle. Cadences are a starting point; your risk profile and audit history decide the final calendar.
| When | Activity | What it involves |
|---|---|---|
| Monthly | Evidence schedule check | Confirm the evidence due that month exists and is dated - access reviews, backup restore tests, vulnerability remediation, training records - and chase the owners where it does not. |
| Monthly | Corrective action tracking | Status of open nonconformities and improvement actions from internal and certification audits, with root cause and effectiveness checks before anything is closed. |
| Monthly | Control-owner check-ins | Short sessions with the people who operate the controls, so ownership stays real and changes in tools or teams are caught early. |
| Quarterly | Risk register review | Risks re-assessed against changes in the business - new products, suppliers, locations, incidents - and treatment plans updated with their owners. |
| Quarterly | Supplier review cycle | Supplier and subprocessor list kept current, with the assurance step for new and critical suppliers actually recorded. |
| On change | Statement of Applicability maintenance | SoA updated when risk treatment changes, a control is added or excluded, or scope moves - with justifications that still match how you operate. |
| Annually | Policy review | Policies and topic-specific procedures reviewed for accuracy, approved by the right owner and re-communicated where they changed. |
| Annually | Internal audit programme coordination | Audit programme planned against risk and previous findings, audit dates set, findings fed into corrective action. The audit itself is performed independently - see below. |
| Annually | Management review preparation | Inputs required by clause 9.3 gathered and presented, so top management makes recorded decisions on the ISMS rather than signing a summary. |
| Annually | Surveillance or recertification readiness | A pre-visit check of last year's findings, evidence freshness and scope changes ahead of the certification body's audit. |
The calendar is agreed at the start of the retainer and sized to the contracted monthly capacity. Activities that do not fit the capacity are scheduled across months or quoted separately - never squeezed in.
What you receive
What we need from you
Responsibilities
A managed system is still your management system. The retainer covers the coordination, upkeep and expert work; decisions, approvals and the controls themselves stay with your people.
Audit independence
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance.
The retainer coordinates the internal audit programme - scheduling, scope, follow-up of findings. The audit itself is either a separate independent audit by another Kellwick auditor, or performed by your own trained auditors or another provider.
Capacity and pricing
The base Managed ISMS retainer covers up to one advisory day per month for one ISMS scope and one legal entity. Higher capacity is agreed in writing before work starts.
Retainer fees are Kellwick consulting fees only. Certification body fees, travel, taxes and third-party tools are separate.
Typical investment
Monthly retainerScoped on a call
Up to one advisory day per month (8 hours)
Up to one advisory day per month for one primary framework, one entity and one agreed ISMS scope. For cross-framework coordination see the Fractional GRC Lead; for senior security leadership, the vCISO.
Delivery
Boundaries
A Managed ISMS keeps the management system operating within the agreed capacity. It does not make Kellwick your CISO, accept risk on your behalf or replace management's responsibility for the ISMS under clause 5. If the work you need is security strategy, executive reporting and programme ownership, the Fractional GRC Lead or vCISO services are the better fit.
Related services
Questions
No. A Managed ISMS keeps the ISO 27001 management system operating: registers, evidence, actions, audit and review cycles. A vCISO provides senior security leadership - strategy, risk prioritisation, executive and board reporting. Many organisations need the first without the second.
Yes, but not by the person who maintains your ISMS. ISO 27001 requires internal audits to be objective and impartial, so the audit is assigned to a separate Kellwick auditor with no involvement in the work, quoted as a separate engagement - or you can use your own trained auditors or another provider.
Around eight hours of specialist time in the month, used against the agreed calendar. That suits a single-entity ISMS with a stable scope. Larger scopes, several sites or a heavy surveillance year need more capacity, which we quote up front rather than letting the calendar slip.
Yes. The first month is a baseline review of the system as it stands, and we tell you plainly what has to be caught up before the retainer can run on schedule.
No. Certification decisions are made by your accredited certification body. The retainer keeps the system operating and the evidence current, which is what the auditor samples.
No. Many clients run the ISMS themselves and use us for an annual independent audit or a pre-surveillance check. The retainer is for organisations that want predictable expert capacity every month.
Tell us your scope, certification body cycle and where the system stands today. We will propose a calendar and the capacity it needs.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.