Is annual cycle just a buzzword? No, it's a key to progress

An annual cycle is far from just another buzzword. It’s a structured way to plan, communicate, and prioritise security tasks – and a powerful framework for discussing the daily operational work with leadership. That’s the opinion of Jacob Høedt Larsen and Marie Bjerre Simonsen from Wired Relations, who recently discussed the value and application of the annual cycle in a webinar.

“Sometimes it’s a challenge in our role as information security professionals to make all the daily tasks visible. We know we need to comply with regulations or meet an ISO standard – and we have to both implement and document that. But there are a lot of operational tasks involved in maintaining and running a compliance setup,” says Marie Bjerre Simonsen.

Multiple cycles – multiple perspectives

When creating an annual cycle (which doesn’t have to be round, by the way), it’s important to remember that there isn’t just one cycle – but many. You might have one for risk management, one for data protection, and one for audits. And that makes sense – because security work is cross-functional, and annual cycles help break down silos between operations and projects.

Some activities take place quarterly, others once a year. What they all have in common is that they require visibility and structure – both to ensure quality and to assess whether the resources are sufficient.

Read more: How to create a flexible annual cycle with Wired Relations

How do you get started?

A good annual cycle is created in close collaboration between the compliance team and leadership. It should reflect both strategic goals and day-to-day realities. So in the end, it is not just about presenting the team’s work to leadership.

“There’s also a perspective from the other side. Management has certain expectations for information security and the broader GRC and compliance area. So when we look at the cycle from above, we also need to ensure we’re using our resources in line with management’s priorities and expectations,” says Jacob Høedt Larsen.

Another important point is to make sure, that the cycle doesn’t become static. Many factors can affect the plans, so regular evaluation is essential. At a minimum, the cycle should be reviewed and adjusted once a year.

At the core of information security is the desire to continuously improve. And that’s exactly what the annual cycle supports – helping us do things a little better than we did last year.

‍