Compliance calendar: annual recurring tasks

Overview

Frameworks and insurance policies depend on recurring evidence. A shared calendar prevents “we forgot last quarter” gaps that show up in audits or claims.

Core entries

Map tasks to your client contracts and frameworks—for example:

• Quarterly privileged access and application access reviews
• Annual policy set review and attestation campaigns
• Incident response tabletop (annual minimum; higher risk quarterly)
• Disaster recovery or backup restore test (at least annually; align RTO/RPO targets)
• Security awareness training and phishing simulations
• Cyber insurance renewal with 60–90 day lead time for questionnaires
• Annual vendor or subprocessors risk review
• Backup immutability and monitoring checks per service tier

Tooling

Use your PSA recurring projects, a GRC module, or a shared calendar with ICS export so executives and vCISO partners see the same dates and owners.

Ownership

Assign a named owner and deputy for each recurring task; avoid a generic “IT team” mailbox that hides accountability.

Integration

Align major renewals with the client’s fiscal calendar and board cycles so budget and steering-committee approvals are predictable.

Review

Once a year, reconvene owners to adjust frequencies after major architecture changes, acquisitions, or new regulatory obligations.

Outcome

A maintained calendar produces continuous evidence, fewer last-minute audit scrambles, and clearer communication with clients about what was tested and when.