How much ongoing maintenance does ISMS software need?

ISMS software should take work off your team’s hands. If you still hunt for evidence, chase approvals by email and copy the same measure into several standards after implementation, much of its value is missing. The question is not only how quickly you set up the system. It is how you work with it afterwards.

In Kopexa, you connect requirements, measures and evidence, review changes to specific document versions and involve employees through the Workforce Hub. Scattered coordination becomes a shared workflow. Your team can spend more time on implementation and answer customer requirements with a traceable basis.

How much time that frees up depends on your existing data and processes. This article helps you examine the ongoing workload concretely before buying.

Key takeaways

• Professional judgement remains your responsibility: assess risks, implement measures and take responsibility for approvals.
• Coordination can be simpler: owners, deadlines, reviews and evidence belong with the relevant work item.
• More standards need not multiply the same work: in Kopexa, shared measures can be mapped to multiple Controls.
• Automation needs a suitable data path: test existing integrations, CSV imports, the GraphQL API and MCP against your actual sources.
• Test a change, not just the first import: that reveals whether the system makes everyday work easier.

What work remains after implementation?

Setting up an ISMS does not make it finished. New suppliers, changed systems and additional customer requirements can create further work. How often you need to review something depends on the subject, your requirements and changes. A blanket monthly hour estimate would not provide a reliable planning basis.

Separate substantive security work from organising that work. Actually restoring a backup is substantive work. Finding the correct test record, identifying its owner and updating three lists is coordination. That is where ISMS software should reduce effort.

The table describes working methods, not blanket automation of every step. For your selection, consider which you actually need in the appropriate plan. See the current pricing and feature overview.

A typical case: changing service providers

Imagine your project portal moves to another service provider. The rule for external access remains. The old test record, however, still describes the previous environment.

With scattered storage, the search often starts here: which policy is valid? Who tests the new access? Where else is the same evidence used? Who updates the records?

In Kopexa, start with the affected measure and its evidence. Check which state the existing record describes, assign the required work and attach the new result. The connection to Controls shows which requirements use the measure. Your team assesses whether the new evidence sufficiently covers each requirement.

If a policy also needs changing, edit it in the document editor and review the specific new version. Then communicate the intended version to affected employees through the Workforce Hub. The change does not end with a completed document.

The benefit: you work on the change and its outcome rather than independently updating the same issue in several repositories. The guide to current and verifiable ISMS evidence explains how to assess what evidence supports.

Multiple standards: maintain one measure and map requirements deliberately

If you work with ISO 27001, TISAX and NIS2 in parallel, another list for each standard rarely provides the relief you want. Kopexa separates Controls, meaning requirements, from the measures used to implement them. One shared measure can be mapped to multiple Controls. Its evidence stays with the implementation.

This is particularly useful when an existing customer adds requirements or a new contract makes another standard relevant. Start with what exists and assess the gaps rather than creating everything again. You can also represent custom requirements and catalogues.

A mapping does not make different requirements identical. Additional scope, a different depth of examination or another period can require further work. The article on using evidence across multiple audits shows how to separate shared work from remaining gaps.

What this means at CSN Solutions

CSN Solutions continued developing its ISO 27001 management system, built over more than ten years, in Kopexa. The case study describes implementing ISO 27001 and around 100 company-specific additional measures. Information security officer Gunnar Mentzel says, translated from German:

“Before, I often didn’t know where to put the evidence. Now it’s: bring it on, I immediately find the right place! Kopexa guides you through, and I not only know where something is, but can assess risks in everyday work much better.”

This is a specific customer account of working with evidence and risks. The CSN Solutions case study describes the starting point and outcome.

What can the API, MCP and AI take on?

Repeatedly copying information from an existing source is a good reason to consider an integration. Kopexa provides a GraphQL API that can also connect internal systems. CSV import paths help with suitable structured data. MCP lets you incorporate Kopexa into your existing working environment through supported AI tools such as ChatGPT, Claude or Langdock.

Examine a specific source: which information should transfer? Who may read or change it? How are errors and outdated data detected? The data path must fit those answers; API access alone is not a fully configured integration.

AI can help prepare and process information. Whether an assessment is appropriate or evidence fulfils a requirement remains a professional decision. Use automation where it reduces repetitive work while retaining control of the outcome.

How to assess maintenance effort before buying

Take a typical everyday case and walk through it with the roles involved. An anonymised evidence record and a policy are enough to start. Do not measure only administrator clicks: include the handover to the business team and reviewer.

1. Find the starting point: which measure, requirements and evidence version are affected?
2. Process the change: can the responsible person take ownership and record the new state?
3. Review the decision: is it clear which version was reviewed and what remains unresolved?
4. Reuse the result: where does the measure support further requirements? What gaps remain?
5. Reach participants: how do employees receive the policy intended for them?

Record which steps disappear, which remain and where an integration needs setting up. This provides a useful basis for your total cost calculation. A demo shows the workflow; the guided trial helps you test it yourselves.

Less ISMS administration. More room for your business.

Your goal is not to spend as much time as possible inside ISMS software. You want to implement security measures, answer customer questions and prepare the next audit with a traceable state. Kopexa connects the requirements, responsibilities and evidence you need.

Show us the workflow that currently takes you the most time in a Kopexa demo. We will walk through it from outstanding work to evidence. That lets you see how Kopexa can simplify your work and what implementation will involve.