Running the ISMS

This chapter describes the recurring work in the ISMS — per domain, with ownership, trigger, cadence and result. The foundation is the hub’s six work areas with 21 pre-filtered lists in total; every group has a Needs attention view for what requires action.

Pages in this chapter

Recurring tasks at a glance

Task	Who (typically)	Trigger / cadence	Where
Record and assess new assets, information and risks	ISMS team, asset owners	on change; review per interval	Managing assets and risks
Classify requirements and maintain fulfilment (SoA)	CISO, control owners	ongoing; review interval per requirement	Maintaining requirements and the SoA
Implement measures, review effectiveness	assignees, accountable	due date; daily monitoring	Implementing and reviewing measures
Run audits, resolve nonconformities	internal audit, CISO	audit programme; 30/14-day deadlines	Handling audits and nonconformities
Approve documents and collect read confirmations	page owners, all employees	per document version; daily reminders	Using document control
Generate reports for management and audits	Jira administrators, CISO	before reviews/audits; as needed	Generating reports
Ask the ISMS questions, draft documents	everyone (with Rovo)	as needed	Using the ISMS Agent (Rovo)

The daily entry point

The fastest overview is the Dashboard (The ISMS Hub at a glance): the Action center tile collects overdue measures, overdue requirement reviews, unassessed risks, pending document approvals, failed automations and due vendor reviews; My work shows your open items and links into document control. The Review cycle traffic light shows overdue, due-within-30-days and on-track reviews.

“ISMS team” dashboard with tiles per work area, Statement of Applicability, risk matrix and action center — “ISMS team” dashboard: tiles per work area, Statement of Applicability, current/target risk matrix and “Action center”.

Screenshots from the development environment with sample data.

Documentation baseline: app version 1.1.15 · 2026-08-20