Compliance Meetings

Regardless of the compliance framework you choose to pursue, whether ISO 27001, ISO 27701, SOC 2, GDPR, or NIS2, it is essential to establish a strong governance structure to maintain it. Regular meetings are crucial to ensuring ongoing compliance, addressing emerging issues, and staying aligned with regulatory requirements. These meetings should have a clear agenda, designated ownership, action points, and proper documentation to support transparency and accountability. 

Follow these steps to ensure you make the most of your compliance meetings: 

Step1: Meeting Attendees: Begin by identifying the stakeholders who should participate in the governance meetings. This typically includes the Compliance Officer, Data Protection Officer (DPO) or Privacy Officer, Security Officer, and sometimes the CEO or other key individuals involved in operations or compliance. Once the core team is established, schedule a recurring monthly meeting to ensure regular discussions and updates. Depending on the topic and the specific needs of your business or organization, you can also invite additional relevant stakeholders to individual meetings as needed. 

Step 2 Preparation: 

Compliance Metrics Review: Owners of compliance metrics should prepare and update the compliance values for that particular month before the meeting to ensure efficiency. 

Review of Outstanding Actions: All attendees should check the overdue Operational Planning and Controls (OPCs) and Improvements assigned to them and determine which topics require evaluation or discussion. 

Regulatory Updates: Any recent regulatory changes or updates relevant to compliance (e.g., changes in GDPR, ISO standards, or NIS2) should be reviewed and added to the discussion if necessary. 

Risk Assessment Review: Identify any new risks or compliance gaps that have emerged since the last meeting and ensure they are documented for discussion. 

Threat Intelligence: Ensure that any relevant threat intelligence information is gathered and prepared before the meeting to address potential security concerns. 

Security Incidents & Data Breaches: Any security incidents or data breaches that occurred in the previous month should be discussed during the meeting. If necessary, appropriate actions should be assigned and tracked. 

Documentation & Reporting: Ensure that all necessary reports, audits, and evidence related to compliance activities are prepared and accessible for reference during the meeting. 

Step 3: Holding Compliance Meeting: 

Start by adding the meeting by selecting the ‘Add New’ button. 

Once you select the ‘Add New’ button, a new screen will appear, as shown below. Ensure that the correct date and attendees are selected before starting the meeting and follow the predefined agenda. 

Step 4: Compliance Agenda & Best Practices 

Document Discussions: Always add notes to indicate that a topic has been discussed or reviewed (e.g., “No changes have been noted following the review”). 

Open Calls to Action (CTAs): Review any open CTAs and address them if possible. The CTAs are usually simple tasks assigned to individual owners, where the content cannot be changed. The assigned owners will receive automated reminders before the due date 

Changes in X-Ray: If there are updates or amendments to the X-Ray, it should be revised accordingly, and the changes should be documented in the Change & Impact subsection of the X-Ray component. Use the Change Management Checklist Template, available in the ‘Templates Section;, to create a checklist and add the link to the component. 

New Customers / Projects: When onboarding a new customer or project, several important steps should be followed to ensure compliance and smooth integration. First, it’s essential to review any legal or contractual requirements specific to the new customer or project, including the drafting or updating of contractual agreements to ensure they align with company policies and regulatory standards. This may involve establishing new data processing agreements (DPAs) if the customer or project requires handling or processing personal data. A Data Protection Impact Assessment (DPIA) may also be necessary, particularly if the new customer or project introduces a new scope of data processing or involves significant changes to existing data flows. It’s also critical to assess whether any new systems or processes need to be implemented for the project or customer, including identifying potential security risks or ensuring that privacy farmwork is well tailored for the new scope. For projects, review any potential impacts on ongoing processes, including whether changes in the project might require updates to the compliance framework, modifications to existing Operational & Planning Control, or technical infrastructure adjustments 

Changes in Suppliers: Verify whether a new supplier has been onboarded or if an existing supplier has been offboarded. If so, assign a CTA to update the supplier records and, if necessary, perform a risk assessment. During the meeting, it is also advisable to review the ‘Supplier Overview Section’ to ensure it is current. If any updates or follow-up actions are required, assign a CTA for further action. 

Changes in People@: Review new team members, role changes, and the offboarding and onboarding of employees. Ensure that the onboarding and offboarding checklists for team members have been created and completed, if applicable. Also, verify that the ‘People@ Section’ is up to date and accurate. 

Progress on Operational Planning and Control (OPCs): During the meeting, review any overdue OPCs and provide justifications for any delays. Ensure that OPCs are correctly labeled as “Ready for Evaluation” and discuss their current status. Additionally, review the planned OPCs for the upcoming month to ensure alignment and readiness for implementation. 

Progress on Improvements: During the meeting, review any overdue improvement tasks and provide justifications for any delays, such as if only the first milestone has been reached. Add progress notes to track developments and set a new due date to ensure continued progress. Additionally, review the planned improvements for the upcoming month to ensure they are on track and aligned with the overall goals. 

Monitor Objectives: Compliance objectives are established on an annual basis. During the meeting, review the progress made toward achieving these objectives and document any relevant updates. Any modifications to these objectives require management approval to ensure they remain aligned with overall business goals and compliance requirements. 

Monitor Threat Intelligence: During the meeting, review and discuss any new threat intelligence information that has been gathered. Focus on verifying whether the Compliance Team has followed the Threat Intelligence process and documented any potential risks or vulnerabilities identified. Assess the impact of any new threats on the organization’s security posture and determine if any immediate actions or updates to the risk management strategy are required. 

Review Metrics (Values & Definitions): Evaluate the definitions and acceptable levels of the metrics to ensure they align with the organization’s goals and compliance standards. Confirm that the metrics are updated for the given month, including any security incidents that may have occurred. Discuss these incidents in detail, document any actions taken, and ensure the metrics reflect the most current and accurate data.  

Other Relevant Topics: In addition to the standard agenda items, take time to address any other relevant topics that may have emerged since the last meeting. This could include updates on ongoing projects, emerging risks, new regulatory requirements, or changes in organizational structure that may affect compliance. Ensure that all topics are discussed thoroughly, with action items assigned where needed. 

Step 5 Calls To Actions (CTA) 

• For each agenda topic, you can create an action point by assigning a Call to Action (CTA),  in the ‘Compliance Meeting Section’ available for each specific topic, as shown above. All CTAs can be viewed in the ‘Calls To Action Section’ where you can also close them once completed.  

• Multiple CTAs can be assigned per topic, so keep them simple and concise, the purpose is to serve as reminders for necessary tasks rather than formal compliance evidence. If you have access to the platform and email notifications are enabled (via People@), you will receive reminders when a CTA is created and again before the deadline.  

• When adding a CTA, a menu will appear where you can provide a brief title, set a deadline, and assign an owner.  

• The progress of CTAs should be the first item discussed in the Compliance Meeting Agenda to ensure timely follow-up and resolution.