Skip to content

PEAKDEFENCEWINGMAN · Use cases

Management review

Prepare the ISO 27001 management review and NIS2 management body oversight with complete inputs, logged decisions and planned follow-up.

Typical requirementsISO 27001 9.3NIS2 Art. 20DORA Art. 5

Stage 1 of 5
Schedule
The review is a recurring item in the plan, with the accountable role.
Plans Roles
Links used
1. Roles accountable for Plans
WINGMAN and AI support
Builds the agenda from ISO 27001 clause 9.3.
Decides: The CISO.
Stage 2 of 5
Collect inputs
Status of earlier actions, audit conclusions, risk changes, incidents, signals and supplier performance.
Conclusions Requirements Risks Incidents Signals Tasks
Links used
1. Conclusions judges Requirements
2. Incidents realises Risks
3. Signals indicates Risks
WINGMAN and AI support
Assembles the pack from the records.
Decides: The CISO reviews it.
Stage 3 of 5
Meeting and minutes
Decisions are recorded in the minutes as a document.
Documents Roles
Links used
1. Roles defined in Documents
WINGMAN and AI support
Drafts the minutes from notes.
Decides: The management body approves.
Stage 4 of 5
Decisions to tasks
Each decision leads to tasks in a plan with owners and dates.
Documents Tasks Plans
Links used
1. Documents leads to Tasks
2. Tasks part of Plans
WINGMAN and AI support
Proposes the tasks.
Decides: Owners accept.
Stage 5 of 5
Next time
Open actions become inputs to the next review.
Tasks Plans
Links used
1. Tasks part of Plans
WINGMAN and AI support
Tracks open actions.
Decides: The CISO.

Screens for this stage · Stage 1: Schedule

The review calendar — Tasks The review calendar Calendar view of all tasks for November 2026: the monthly and high-risk reviews the plans generated, plus the quarterly management review meeting.

Plans: recurring and one-off programmes — Plans Plans: recurring and one-off programmes Each plan groups the tasks it generates (asset, access, policy and risk reviews, internal audit) with its activities, owner and progress. Propose a plan asks WINGMAN to draft one.

Sector angles

What this use case looks like under specific regulations.

NIS2

The management body sees exposure, incidents, overdue work and approves the measures, with minutes and decisions kept.

Financial sector

The management body reviews exposure against risk appetite, events and remediation status.

ISO 27001 / SOC 2

Inputs required by clause 9.3 come from live records; decisions become tracked tasks.

Videos

WINGMAN AI GRC – financial sector (DORA, MiCA, ECB) Live signals on critical functions, ICT and supply-chain risk, major incidents decided by people, and supervisor reports drafted for submission.

Running a regular ISMS management review with WINGMAN AI Preparing and running the management review from live records, and turning its decisions into tracked tasks.

Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.

Other use cases

New requirements

Implement a new regulation or standard by reusing and linking what already exists, then drive the rest with tasks and plans.

GDPR and DPIA

Keep processing chains and their risks current, and support data protection impact assessments.

EU AI Act

Keep an AI use case registry and link each use case to its obligations, risks and controls.

See WINGMAN on your own data

We can walk through any of these use cases with your requirements, risks and controls.

Contact Peak Defence