The Compliance Calendar: TLS Tasks by Framework, by Quarter
A gardener knows the calendar. Spring is for planting. Summer is for watering and deadheading. Autumn is for pruning and clearing leaves. Winter is for the long, slow jobs - mulching, planning, ordering seeds. You can do all the work in any month if you want. You will get better results if you do the right work in the right month.
Compliance has the same rhythm. Different frameworks have different deadlines. Different tasks recur at different cadences. Certificates need attention on their own schedule that overlaps but doesn't match the audit schedule. Trying to do everything at once leaves things half-done. Trying to do everything continuously without a calendar means urgent things keep displacing important things.
Here's a practical compliance calendar for TLS - what to do annually, what to do quarterly, what to do monthly, and what to handle ad-hoc when it comes up. Tuned for organisations subject to PCI-DSS, SOC 2, HIPAA, ISO 27001, or some combination of these.
Why compliance has seasonality
Three reasons compliance work is not evenly distributed across the year.
Audit windows are bounded. Most external audits are annual or biennial events with defined windows. The work to prepare clusters in the weeks before. The work to remediate findings clusters in the weeks after. Compliance teams are quietly very busy at these times and quieter in between.
Some controls have natural cadences. Quarterly penetration tests. Annual policy reviews. Monthly vulnerability scans. These aren't artificial; they're tied to the rate of change in the underlying systems.
Some changes are exogenous. A CA deprecates OCSP. NIST publishes a new SP. A new ballot at the CA/Browser Forum changes the cert validity calendar. These hit on their own schedule and you have to fit them in.
Trying to ignore the seasonality means the audit-prep crunch is harder than it needs to be. Building around it means quieter, more predictable work.
The annual rhythm
What happens once a year, on a regular cadence.
Annual policy review. Update the cryptography policy, the cert management policy, the incident response runbook. Reflect any changes in the standards landscape (NIST updates, CA/B Forum ballots, framework updates).
Annual external audit. Whichever framework you're certified to. Usually clusters in a specific calendar quarter - varies by organisation. SOC 2 audits often happen in the same window each year because the report covers a 12-month period.
Annual cert ownership review. For every cert, confirm the recorded owner is correct. Update what's wrong. This catches the slow drift that's the most common cause of cert orphaning.
Annual cipher baseline review. Update the documented cipher baseline based on the year's changes - new deprecations, new recommendations, post-quantum progress. Roll the change out to production after testing.
Annual scope review. Confirm which systems are in scope for which compliance frameworks. Re-evaluate any boundaries that have shifted.
The quarterly rhythm
What happens every three months.
Quarterly cert inventory reconciliation. Run the inventory automation. Compare against CT logs, cloud APIs, internal CAs, network scans. Investigate discrepancies. This is the single highest-leverage recurring activity for cert hygiene.
Quarterly vulnerability scan review. Look at all the TLS-related vulnerabilities scanned over the past quarter. Confirm remediation timelines for anything outstanding.
Quarterly tabletop incident exercise. Run through a TLS-related incident scenario with the team. Identify gaps in the runbook. Update.
Quarterly access review. Who has access to issue certs? Change cipher configurations? Revoke? Confirm the list is still right.
The monthly rhythm
What happens every month.
Monthly TLS configuration scan. Run external scans against every endpoint in scope. Review the report. File issues for anything below baseline.
Monthly renewal preview. Look at certs renewing in the next 60 days. Confirm renewal automation is configured. Manually triage anything that doesn't auto-renew.
Monthly cross-team check-in. A short standing meeting where cert-related issues from different teams get surfaced - not every team monitors itself for this, and the standing meeting catches what individual teams miss.
The continuous things
What runs all the time, not on a calendar.
Continuous external monitoring of expiry, chain, cipher, hostname, revocation, and known vulnerabilities. The point of "continuous" is that it doesn't need scheduling.
Continuous CT log monitoring for unexpected certs issued for your domains.
Continuous renewal automation for ACME-managed certs.
Continuous incident response capability when something fires.
These are the foundation. The calendar above is the layer of human attention on top of them.
The ad-hoc things that interrupt the calendar
Some events don't fit into any cadence. They happen when they happen.
A CA deprecation announcement - like Let's Encrypt's OCSP deprecation. Triggers a one-off review of dependencies and a possible migration project.
A vulnerability disclosure - like Heartbleed in 2014, ROBOT in 2017. Triggers urgent scanning, patching, and possibly cert rotation.
A merger or acquisition - triggers an inventory absorption project.
A new regulation - like the December 2024 HIPAA NPRM. Triggers a policy review and a remediation roadmap.
A breach or near-miss - triggers a post-mortem and structural changes.
Don't try to schedule these. Plan for them by reserving capacity - a rule of thumb is that 15-20% of compliance capacity should be unscheduled, available for whatever comes up.
A worked annual example
For a SaaS organisation subject to SOC 2 and PCI-DSS, with a fiscal year ending December:
January-February: SOC 2 audit prep. Inventory snapshot. Configuration scan reports. Incident records gathered. March: SOC 2 audit window. April: SOC 2 findings remediation. Annual policy review. May-June: Quieter months. Quarterly inventory reconciliation. Annual cipher baseline review. July-August: PCI-DSS quarterly scan reviews. Mid-year cross-team check-ins. September: PCI-DSS internal pre-audit. Tighten anything before external attention arrives. October: Annual external PCI assessment. November: PCI findings remediation. Tabletop exercise. Annual cert ownership review. December: Quieter again. Closing-out year, planning next year's policy changes.
Every organisation's calendar looks slightly different. The shape - audit clusters, quarterly recurring tasks, continuous monitoring, ad-hoc events - is consistent.
One small ask
The compliance calendar isn't a complicated artifact. It's a half-page of when things happen, who owns each, and what evidence each produces. Once you have it, the urgent audit weeks become predictable instead of stressful. TLS Radar produces the continuous monitoring evidence that anchors the calendar; the policy and process are yours. The 30-day free trial covers three domains, which is enough to see what one quarter of audit evidence would look like before you need it.
Related reading
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.