Use cases
Where policy documents become evidence.
A policy says what you will do. A meeting is where you do it. These are the moments, and the meetings, where MeetEvi turns the doing into a record you can open.
Six moments a policy cannot carry.
Policies are good at saying what should happen. These are the moments when somebody asks whether it did.
-
Going into your first audit
The policies are written and approved. Now the auditor wants to know the programme runs, and the only proof is whatever your meetings left behind.
Choose ISO 27001, SOC 2 or both and MeetEvi sets up the meetings the standard expects, each with a fixed agenda. Every meeting you hold leaves a record you can open.
What you can open afterwards
- A dated record for every meeting held
- Each agenda topic marked covered, touched on or not covered
- The words behind every mark
-
Staying honest between audits
Nothing goes wrong on the day. The review is held, the right people turn up, and nobody notices that the same topic was skipped again.
The agenda stays fixed, so every meeting is checked against the same topics. Hold one four times and the topic that keeps slipping stands out.
What you can open afterwards
- The same meeting, side by side across quarters
- The topic that was never covered, named
- What was deferred, and to when
-
Following two standards at once
ISO 27001 and SOC 2 both ask for an access review. They are not the same meeting, and the evidence for one is not automatically the evidence for the other.
Each standard declares its own meetings and its own agendas, and MeetEvi keeps them apart. Adopt both and you get two access reviews, each with its own record.
What you can open afterwards
- One programme view across both standards
- Separate agendas and separate records
- The hours a year each standard asks of your people
-
Handing the programme to someone new
The person who ran compliance moves on. What was said in the room, and what was promised, leaves with them.
The record does not live in an inbox or in anybody's head. Transcripts are kept and never edited, so a new owner can open any past meeting and read what was said.
What you can open afterwards
- Every past meeting in the workspace
- Actions agreed, each with a named owner
- Each disagreement with a verdict, in writing, with a name and a date
-
Showing that leadership took part
A management review is where leadership owns the programme. Too often it is a calendar slot and a paragraph of minutes.
The review is checked against nine topics, from audit findings and risks to people, budget and actions with named owners. What leadership skipped is named, not smoothed over.
What you can open afterwards
- Who spoke, and what they said
- What was decided, and what was put off
- Actions with an owner, by name
-
Answering “show me”
An auditor, a customer’s security team or your own board asks whether you really do what the policy says. A document can only repeat the claim.
Open the meeting and press the mark. The transcript moves to the words that were spoken. Today you show the screen or give the person an account; there is no export yet.
What you can open afterwards
- The agenda, topic by topic
- The verdict, and the reason for it
- The moment in the transcript it rests on
A meeting that finds the gap, then closes it.
The same user access review, one quarter apart. In June the leavers list was mentioned and never checked. In September the check happened in the room, and the record shows it.
- Touched on
User accounts checked against the HR leavers list Sam Lee, turn 6
- Covered
Privileged and administrator access re-approved Dana Struct, turn 9
- Not covered
Access nobody needs any more removed No supporting evidence found.
Sam Lee turn 6, 14:20
Two people left since March. I have not compared their names with the account list yet.
- Covered
User accounts checked against the HR leavers list Sam Lee, turn 4
- Covered
Privileged and administrator access re-approved Dana Struct, turn 8
- Covered
Access nobody needs any more removed Sam Lee, turn 5
Sam Lee turn 4, 3:15
I ran the leavers list against the account export this morning. Two accounts were still active, and both are disabled now.
Nothing in the second record was written up afterwards. It is what was said, next to the topic it answers.
An illustration, not a customer’s record. Three of the six topics are shown.
Every meeting, and what it records.
Open a meeting to see its agenda, the question behind it, and what you can press afterwards.
ISO/IEC 27001:2022
9 recurring meetings, about 22.5 hours a year
Management review “Did leadership actually review the programme, and what did they decide?” Twice a year, 90 minutes
Leadership looks at whether the security programme is working and decides what changes.
Checked against 9 topics
- ISMS performance since the last review reviewed
- Audit results and open findings reviewed
- Current information security risks reviewed
- Incidents and near misses since the last review discussed
- Progress against the security objectives reviewed
- Compliance status reviewed
- Improvements to the programme agreed
- Whether the programme has the people and budget it needs decided
- Action items agreed, each with a named owner
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Risk assessment review “Is the risk register kept alive, or written once and filed?” Once a year, 90 minutes
The risk register is re-read, re-scored, and brought back in line with what the business actually does now.
Checked against 6 topics
- Every open risk on the register reviewed and re-scored
- New threats and vulnerabilities considered
- New risks from changes to the business or technology identified
- Treatment plans agreed for anything above appetite
- An owner confirmed for every risk
- Risk acceptance decisions made and recorded
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
User access review “Who checked that leavers lost their access?” Every quarter, 45 minutes
Confirm every account still belongs to somebody who needs it.
Checked against 6 topics
- User accounts and their roles reviewed
- Privileged and administrator access re-approved
- Inactive accounts identified
- User accounts checked against the HR leavers list
- Access nobody needs any more removed
- Approval confirmed for every permission kept
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Supplier and third-party review “How do you know your suppliers are still safe to depend on?” Once a year, 60 minutes
Look at who we depend on, what they hold, and whether they are still safe to depend on.
Checked against 7 topics
- Each supplier's performance reviewed
- Each supplier's security posture checked against its assurance evidence
- Security terms confirmed present in supplier agreements
- Risks each supplier brings reviewed
- Compliance requirements confirmed as met by each supplier
- Supplier issues identified and the remediation each needs agreed
- Changes to supplier risk ratings decided
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Incident review “What went wrong, and what changed because of it?” Every quarter, 45 minutes
Go through what went wrong since last time, and what we changed because of it.
Checked against 6 topics
- Every incident since the last review walked through
- Root cause agreed for anything significant
- The response to each incident reviewed
- Lessons learned recorded
- Actions from previous incidents confirmed as closed
- Improvements to prevent recurrence identified
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Business continuity and DR tabletop exercise “Have you ever practised this, or only written it down?” Once a year, 90 minutes
Walk through a disruption on paper to find out whether we could actually respond and recover.
Checked against 7 topics
- A disruption scenario simulated from start to finish
- The response to the scenario reviewed
- Recovery of systems and services reviewed
- Communication during the disruption reviewed
- Who is responsible for each step confirmed
- Gaps in continuity and recovery readiness identified
- An action and an owner assigned for each gap
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Vulnerability and patch review “Who owns each open vulnerability, and by when will it close?” Every month, 30 minutes
Keep known weaknesses from sitting open by checking what is unpatched and who is closing it.
Checked against 6 topics
- Open vulnerabilities reviewed
- Patch status across systems reviewed
- Critical findings reviewed
- Remediation progress since the last review reviewed
- Overdue items prioritised
- An owner and a closure date assigned to every open item
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Secure development review “How do you know insecure code does not ship?” Every quarter, 45 minutes
Check that the software we build and change is being built securely before it ships.
Checked against 7 topics
- Secure coding practice reviewed
- Code reviews since the last meeting reviewed
- Security testing results reviewed
- Application vulnerabilities reviewed
- Recent application changes reviewed for security impact
- Open security issues tracked
- Remediation required before release confirmed
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Internal audit closing meeting “Who accepted each finding, and who owns the fix?” Once a year, 30 minutes
The auditor presents what they found, and the findings are accepted with owners and dates.
Checked against 6 topics
- Each finding presented and accepted or challenged
- Nonconformities reviewed
- Observations reviewed
- Areas of improvement discussed
- A corrective action agreed for each nonconformity
- An owner and a date agreed for every accepted finding
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
SOC 2 (2017 Trust Services Criteria)
3 recurring meetings, about 7 hours a year
Control effectiveness review “Does management confirm that each control is operating?” Twice a year, 90 minutes
Management sits down with the control set and says, one by one, whether it is actually operating.
Checked against 3 topics
- Control exceptions since the last review discussed
- Every control confirmed to still have a named owner
- Policy changes since the last review reviewed and approved
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Access review “Who approved the access that was granted, and who removed what was not needed?” Every quarter, 45 minutes
Confirm every account still belongs to somebody who needs it.
Checked against 3 topics
- Access granted since the last review confirmed as authorised
- Access removed for everyone who left or changed role
- Privileged and administrator access re-approved
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Vendor risk review “Did you obtain and read your critical vendors’ assurance reports?” Once a year, 60 minutes
Look at the vendors we rely on and whether their assurance still stands up.
Checked against 3 topics
- The vendor list reviewed and corrected
- Current SOC 2 or equivalent reports obtained for critical vendors
- Exceptions in vendor reports discussed and accepted or actioned
Afterwards each topic is marked covered, touched on or not covered, with the words that were said. A person can disagree in writing, and the original stays.
Who it helps.
The people in the room, and the person who asks about it later.
-
The person who owns compliance
Compliance is a third of your job. The record writes itself, and each topic nobody covered is named for you, so you stop chasing minutes.
-
The CISO or head of security
Hold the review and move on. What was decided, and what was put off, is on record rather than in anybody’s memory.
-
Everyone else who attends
You know the agenda before you walk in, and your actions are on record with your name beside them.
-
The auditor
Press any mark and read the words behind it. Bring yours and let them look.
Where it does not fit.
Better to know before the demo than after the contract.
-
Only meetings made through MeetEvi.
The notetaker joins under its own name, camera off, and cannot be pointed at any other call.
-
Google Meet today, Microsoft Teams next.
Zoom is not supported.
-
Two standards, for now.
ISO/IEC 27001:2022 and SOC 2. If you follow something else, tell us which and we will give you a straight yes or no.
-
No score, and no verdict on compliance.
Whether you are compliant is for you and your auditor to decide.