Regular reviews

Run the reviews good practice expects (assets, documents, risks, incidents, access) on a calendar instead of from memory.

Typical requirementsISO 27001NIS2DORA

Stage 1 of 6
Review calendar
One plan holds every recurring review with its cadence.
Plans Roles
Links used
1. Roles accountable for Plans
WINGMAN and AI support
Builds the calendar from the requirements that ask for reviews.
Decides: The CISO approves.
Stage 2 of 6
Assets and suppliers
Owners confirm their assets, dependencies and suppliers are current.
Plans Assets Suppliers Roles
Links used
1. Plans reviews Assets
2. Roles owns Assets
3. Suppliers provides Assets
WINGMAN and AI support
Lists stale records per owner.
Decides: Owners confirm.
Stage 3 of 6
Documents
Policies and procedures come up for review on their cycle.
Plans Documents Roles
Links used
1. Plans reviews Documents
2. Roles defined in Documents
WINGMAN and AI support
Highlights what changed since the last version.
Decides: Document owners approve.
Stage 4 of 6
Risks and incidents
Risks are reviewed together with the incidents of the period.
Plans Risks Incidents
Links used
1. Plans reviews Risks
2. Incidents realises Risks
WINGMAN and AI support
Prepares the review pack.
Decides: Risk owners decide.
Stage 5 of 6
Access
Access review is a control with evidence each period: who holds which role and which access.
Controls Evidence People Roles
Links used
1. Controls proven by Evidence
2. People holds Roles
WINGMAN and AI support
Compares access lists with roles.
Decides: Managers confirm.
Stage 6 of 6
Delays
Overdue reviews show up as late tasks with their owners.
Tasks People Plans
Links used
1. People assigned Tasks
2. Tasks part of Plans
WINGMAN and AI support
Sends reminders in your name after you approve them.
Decides: You decide who is reminded.

Screens for this stage · Stage 1: Review calendar

Plans **Plans: recurring and one-off programmes** Each plan groups the tasks it generates (asset, access, policy and risk reviews, internal audit) with its activities, owner and progress. Propose a plan asks WINGMAN to draft one.

Tasks **The review calendar** Calendar view of all tasks for November 2026: the monthly and high-risk reviews the plans generated, plus the quarterly management review meeting.

Screens for this stage · Stage 3: Documents

Documents **Policies and procedures with versions** Six documents with owner and version. The portfolio summary notes that none is formally approved yet.

Screens for this stage · Stage 4: Risks and incidents

Tasks **A review task with its prepared brief** WINGMAN prepares the review when the task is created: what changed since the last review, any suggested changes, and one button to confirm that the risk still stands.

Tasks **The review brief with a suggested rating change** After Start review, the brief proposes likelihood 3 → 4 with its reasoning: the system is in active use and no accuracy monitoring is deployed yet. Accept or Skip, then Complete review.

Screens for this stage · Stage 5: Access

Settings **Members, titles and roles** Each member has a title (CEO, Developer, Incident Response Lead, CISO) and an access role, directly or through a group.

Screens for this stage · Stage 6: Delays

Tasks **Overdue tasks across the organisation** The Overdue quick view lists late work with its assignee, so delays surface as people's names, not as a number.

The Brief **Gaps to close and the organisation's temperature** Eleven register checks run on every record: risks without an owner or score, requirements without a control, tasks overdue by more than 30 days, vulnerabilities past the patching SLA, unapproved documents. Each gap links to the records behind it.

Sector angles

What this use case looks like under specific regulations.

ISO 27001 / SOC 2

Asset, risk, document and access reviews run on schedule, each leaving a task and evidence behind.

GDPR

The record of processing, retention and processor agreements are reviewed on schedule.

Videos

**ISMS implementation with WINGMAN AI** Building an information security management system in WINGMAN, from requirements and scope to risks, controls, owners and the review cycle.

Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.

Other use cases

Incident handling

Support every stage of an incident, from the first signal to the risk review it should trigger.

Supplier evaluation

Evaluate a supplier for feasibility before onboarding, and keep watching it afterwards.

Change management

Assess a planned change for impact, decide the controls needed before and after it, and keep one set of records as the result.

Security operations control

Run security work through plans and tasks, with briefs, reminders and escalations, and ask "what needs to be done" against everything the model knows.

All use cases