In brief
Across ISO 27001, SOC 2, HIPAA, PCI-DSS and GDPR, certification is a project but maintaining compliance is ongoing work most teams aren't set up for.
Maintaining compliance is harder than getting certified because certification is a project with an end date, while every framework expects controls to keep operating afterwards: ISO 27001 through yearly surveillance audits, SOC 2 through a new report each period, PCI DSS through an annual assessment, and HIPAA and GDPR through documentation you must be able to produce at any time. Most teams staff the project, not the operation.
Why does every framework have the same problem after certification?
Whether you just achieved ISO 27001, a SOC 2 Type II report, HIPAA readiness, PCI DSS or GDPR compliance, the pattern is the same. The project ends, the consultant's engagement closes, the badge goes on the website, and the controls built for the audit stop being run on a schedule. By the next audit, nobody has maintained what was built. That is not a failure of effort; it is what happens when compliance is run as a project with an end date instead of an operating function with owners and a calendar.
What does each framework expect after certification?
Each framework checks continuity in its own way. This table summarizes the recurring obligations most teams underestimate.
| Framework | How continuity is checked | Recurring obligations to plan for |
|---|---|---|
| ISO 27001 | Surveillance audits in years 1 and 2, recertification in year 3 | Internal audit (clause 9.2), management review (9.3), risk assessment at planned intervals (8.2), policy review (A.5.1), access reviews (A.5.18) |
| SOC 2 Type II | A new report for each period, typically 3 to 12 months; the AICPA sets no minimum | Evidence for every instance of every control across the whole period |
| PCI DSS v4.0.1 | Annual assessment (ROC or SAQ) | Scope confirmation every 12 months (12.5.2), quarterly ASV scans (11.3.2), annual penetration test (11.4), access review every 6 months (7.2.4) |
| HIPAA | No certificate; OCR investigations and compliance reviews ask for documentation | Periodic evaluation (164.308(a)(8)), training (164.308(a)(5)), documentation kept 6 years (164.316(b)(2)) |
| GDPR | No audit cycle; you must be able to demonstrate compliance (Article 5(2)) | Regular testing of security measures (Article 32(1)(d)), DPIAs for high-risk processing (Article 35), processor contracts (Article 28) |
Sources: ISO/IEC 27001:2022, the AICPA SOC 2 overview, the PCI SSC document library, the HIPAA Security Rule (45 CFR Part 164 Subpart C) and the GDPR text on EUR-Lex.
Why doesn't the certification project prepare you for maintenance?
Consultants are hired to get you through the audit, and their scope usually ends there. They write policies, help implement controls and assemble the evidence package, but rarely build the routine that keeps those controls running for the next 365 days. Meanwhile compliance is usually a side job: in most companies without a dedicated compliance team, the CTO, an engineering manager or an IT lead carries it on top of a full workload. Without reminders and owners, recurring work slips until the next audit is close.
What goes wrong in the first year after certification?
Five problems appear in almost every team:
- Evidence is scattered. Cloud logs, access review emails, scan reports, training records, vendor files and incident threads live in different systems. When the auditor asks for evidence from February to August, someone has to dig.
- Deadlines pass silently. Policy reviews, risk assessments, penetration tests, continuity tests (ISO 27001 A.5.30) and DPIAs (GDPR Article 35) have no reminder, so they surface as audit findings.
- Nobody has the full picture. Security knows technical controls, HR knows training, legal knows contracts, engineering knows configurations. "How compliant are we right now?" takes days to answer.
- Multiple frameworks multiply the work. Access review evidence can serve ISO 27001 A.5.18, SOC 2 CC6.2 and CC6.3, PCI DSS 7.2.4 and HIPAA 164.312(a)(1) at once, but without a control mapping teams collect it separately for each.
- The person who built it leaves. Knowledge of where evidence lives and who owns which policy sits in a few heads, and the successor rebuilds it under audit pressure.
The operational side of these problems, such as orphaned accounts and configuration drift, is covered in 5 gaps continuous compliance tracking surfaces.
How do you move from a compliance project to compliance operations?
Treat compliance like monitoring or payroll: a function with owners, a calendar and records.
| Aspect | Compliance as a project | Compliance as operations |
|---|---|---|
| Evidence | Collected before the audit | Collected on each task's schedule, automatically where possible |
| Recurring reviews | Remembered late, found as findings | Owner, due date and reminders for each |
| Status | Unknown until someone checks | Visible on a dashboard |
| Adding a framework | Repeats work already done | Shared controls, mapped once |
| Knowledge | In people's heads | In the system, with history |
| Auditor access | Folders and zip files | A scoped workspace with requests and evidence |
For a worked example of ISO 27001 and PCI DSS running side by side, read maintaining ISO 27001 and PCI DSS after certification. To use each review as a risk signal, see compliance tracking as an early warning system.
How does pTrackly help with maintaining compliance?
pTrackly is built for the operating phase. Evidence tasks have a frequency, owner and review date, with reminders 7, 3 and 1 days before they are due and escalation when they run overdue; policies have review dates with the same reminders. Controls are shared across frameworks, so adding ISO 27001 on top of SOC 2 reuses overlapping controls and tasks instead of duplicating them. Integrations and scheduled cloud checks collect evidence without screenshots, and audits run in a shared workspace where the external auditor sees only the audits they are invited to. pTrackly does not run your controls or issue certificates: your team operates the controls and the certification body or CPA firm performs the audit. pTrackly itself went through ISO 27001 readiness in 3 weeks and a 4-week certification audit on the platform; that was our own project, and scope changes timelines. See pTrackly for teams after certification.
Frequently asked questions
Why is maintaining compliance harder than getting certified?
Certification is a funded project with a deadline and outside help. Maintenance is recurring work spread across teams, usually done by someone with another full-time job, and nothing reminds them until the next audit.
How often is an ISO 27001 certificate audited after certification?
The certification body performs surveillance audits in the first and second years and a recertification audit before the three-year certificate expires.
Does a SOC 2 report need to be renewed?
A SOC 2 report has no official expiry, but customers usually expect a report whose period ended within the last 12 months, so most companies run a Type II examination every year with consecutive periods.
Can one set of evidence cover several frameworks?
Often, yes. An access review can satisfy ISO 27001 A.5.18, SOC 2 CC6.2 and CC6.3, PCI DSS 7.2.4 and HIPAA 164.312(a)(1) if it covers the systems each framework scopes in. Map controls once and collect against the mapping.
