Scheduled maintenance recipes

Run the monthly document staleness sweep.

1. Read GRC.md at the repository root. Use section 4 for the document register
   and policy locations. If it is missing, stop and write a short report saying
   what is missing.
2. Build the list of documents with owner, last review date and review interval
   from the register, or from the interval each policy states. Call
   list_documents to see which documents are uploaded to ISMS Copilot: for a
   named workspace, first call list_workspaces for its workspace_id and pass
   it; for "personal", call it without workspace_id. Never treat created_at as a review date. If list_documents returns 200
   entries, say in the report that older uploads may be missing.
3. Mark each document as overdue, due within 60 days, current, or "review date
   unknown". Read the earlier staleness reports in the output location, if any,
   and keep only documents not already flagged in a report dated after the
   document's last recorded review. A "review date unknown" document is
   reported once, then not again until a review date is recorded.
4. If there are newly flagged documents, call create_conversation once
   (answer_format "brief", mode fast, workspace_id if set) and ask, for each by
   title and purpose (not its full text), what a reviewer should check given
   the frameworks in our scope. Use send_message on the same conversation for
   follow-ups. Whenever a call returns status "generating", poll get_reply
   until "complete" before sending the next message.
5. Verify only what ISMS Copilot marks as unconfirmed or says it cannot confirm,
   against the official source text; list anything you cannot verify as "not
   verified". Do not re-check confirmed answers.
6. Write YYYY-MM-DD-document-staleness.md to the output location in GRC.md
   section 8: a table of newly flagged documents (document, owner, last review,
   status), one proposed review note per overdue or due document, the "review
   date unknown" documents for a person to date, and a "Verified" note. Assign
   each proposal to the approver in GRC.md section 6. Do not edit any policy or
   register. The last line is "Ran YYYY-MM-DD: N findings".

30 7 2 * * cd /path/to/grc-repo && claude -p "$(cat prompts/document-staleness.txt)" --allowedTools "Read,Glob,Grep,Write,mcp__ismscopilot__list_workspaces,mcp__ismscopilot__list_documents,mcp__ismscopilot__create_conversation,mcp__ismscopilot__send_message,mcp__ismscopilot__get_reply" >> grc-reports/cron.log 2>&1

Run the memory hygiene review. Do not change any memory in this run.

1. Read GRC.md at the repository root. If it names an ISMS Copilot workspace,
   call list_workspaces to get its workspace_id.
2. Call list_memories for the workspace (and without workspace_id for personal
   memories if GRC.md says personal memories are in scope).
3. Compare each memory with the systems of record GRC.md points to. Flag
   memories that duplicate each other, contradict a system of record, reference
   dates that have passed, or name systems, people or scope that no longer apply.
4. For memories that state a framework fact, call create_conversation once
   (answer_format "brief", mode fast, workspace_id if set) and ask whether each
   statement is still accurate. Use send_message on the same conversation for
   the rest, polling get_reply until "complete" whenever a call returns status
   "generating". Verify only what ISMS Copilot marks as unconfirmed or says it
   cannot confirm, against the official source text; list anything you cannot
   verify as "not verified".
5. Write YYYY-MM-DD-memory-hygiene.md to the output location: one row per
   flagged memory with memory_id, current text, the problem, and the proposed
   new text (max 500 characters) or "retire". Add an empty checkbox per row for
   the approver in GRC.md section 6. Add a "Verified" note. The last line is
   "Ran YYYY-MM-DD: N findings".

Read the approved memory hygiene report at <path>. For each row whose checkbox
is ticked and whose proposal is new text, call update_memory with that
memory_id and the approved text, exactly as written. Skip unticked rows.
update_memory only works on memories this token's user created: if a call
fails for a teammate's memory, list it for that person to update by hand. For
rows marked "retire", do not change them: list them so a person can delete
them in the ISMS Copilot web app. Report what you changed.

0 10 15 1,4,7,10 * cd /path/to/grc-repo && claude -p "$(cat prompts/memory-hygiene.txt)" --allowedTools "Read,Glob,Grep,Write,mcp__ismscopilot__list_workspaces,mcp__ismscopilot__list_memories,mcp__ismscopilot__create_conversation,mcp__ismscopilot__send_message,mcp__ismscopilot__get_reply" >> grc-reports/cron.log 2>&1

Run the question triage digest.

1. Read GRC.md at the repository root, then the questions inbox it names. If
   GRC.md names a workspace, call list_workspaces to get its workspace_id. Read
   all earlier triage reports in the output location, if any, and keep only
   questions that appear in none of them. If there are none, write a report containing
   only the line "Ran YYYY-MM-DD: 0 findings" and stop.
2. Call create_conversation once for this run (answer_format "decision", mode
   fast, workspace_id if GRC.md names a workspace). Send the first question,
   then each remaining question with send_message on the same conversation.
   Send the question and the relevant facts, not whole documents. Whenever a
   call returns status "generating", poll get_reply until "complete" before
   sending the next question.
3. For each question, record: the draft answer, the framework references given,
   whether the answer depends on evidence we hold (and where GRC.md says that
   evidence lives), and the approver from GRC.md section 6.
4. Verify only what ISMS Copilot marks as unconfirmed or says it cannot confirm,
   against the official source text; list anything you cannot verify as "not
   verified". Do not re-check confirmed answers.
5. Write YYYY-MM-DD-question-triage.md to the output location. Put questions
   whose deadline is within 48 hours at the top, under "Due within 48 hours".
   Then one section per question with status "draft ready for review", "needs
   evidence from <owner>" or "needs a decision from <approver>", and a
   "Verified" note. Do not send any answer to anyone. The last line is
   "Ran YYYY-MM-DD: N findings".

0 8 * * 2,4 cd /path/to/grc-repo && claude -p "$(cat prompts/question-triage.txt)" --allowedTools "Read,Glob,Grep,Write,mcp__ismscopilot__list_workspaces,mcp__ismscopilot__create_conversation,mcp__ismscopilot__send_message,mcp__ismscopilot__get_reply" >> grc-reports/cron.log 2>&1

Run the pre-audit evidence checklist.

1. Read GRC.md at the repository root and take the audit date from section 2.
   If the audit date is missing or has passed, write a report containing only
   "Ran YYYY-MM-DD: 0 findings (no upcoming audit date in GRC.md)" and stop.
   If the audit is more than 30 days away and today's day of the month is
   greater than 7, write a report containing only
   "Ran YYYY-MM-DD: 0 findings (not in audit window)" and stop.
2. Call list_documents and list_memories to know what is already uploaded and
   what facts are recorded: for a named workspace, first call list_workspaces
   for its workspace_id and pass it; for "personal", call them without
   workspace_id. If list_documents returns 200
   entries, note that older uploads may be missing.
3. Call create_conversation once for this run (answer_format "decision", mode
   think, workspace_id if set) and ask for the evidence an auditor typically
   requests for the audited framework and our scope, grouped by requirement.
   If a previous checklist exists in the output location, summarise its open
   gaps in that first message so the answer builds on it. Use send_message on
   the same conversation for follow-ups. Whenever a call returns status
   "generating", poll get_reply until "complete".
4. For each evidence item, check the evidence locations in GRC.md section 4
   that you can read, and mark it "found at <path>", "not found" or "cannot
   check from here". Do not judge whether found evidence is sufficient: that is
   the approver's call.
5. Verify only what ISMS Copilot marks as unconfirmed or says it cannot confirm,
   against the official source text; list anything you cannot verify as "not
   verified".
6. Write YYYY-MM-DD-pre-audit-checklist.md to the output location: days to the
   audit, a table (requirement, evidence item, status, owner), the gaps first,
   then a "Verified" note. The last line is "Ran YYYY-MM-DD: N findings", where
   N is the number of gaps.

0 9 * * 3 cd /path/to/grc-repo && claude -p "$(cat prompts/pre-audit-checklist.txt)" --allowedTools "Read,Glob,Grep,Write,mcp__ismscopilot__list_workspaces,mcp__ismscopilot__list_documents,mcp__ismscopilot__list_memories,mcp__ismscopilot__create_conversation,mcp__ismscopilot__send_message,mcp__ismscopilot__get_reply" >> grc-reports/cron.log 2>&1

Prepare the access review. Do not change any access, account or group.

1. Read GRC.md at the repository root. Take the people and access register
   from section 4. If it is missing, stop and report what is missing. If GRC.md
   names a workspace, call list_workspaces to get its workspace_id.
2. List current members and privileged roles for each system the register
   covers, using read-only commands only (for example: gh api orgs/<org>/members,
   and the cloud CLI's list commands for users and role assignments). Record
   the command used for each list in the report.
3. Call create_conversation once (answer_format "brief", mode fast,
   workspace_id if set) and ask what a periodic access review should check for
   our scope, for example leavers, dormant accounts, shared accounts and
   privileged roles. Use send_message on the same conversation for follow-ups,
   polling get_reply until "complete" whenever a call returns status
   "generating".
4. Compare the lists with the register. Draft: accounts with no matching person
   (possible leavers), people with more rights than their role in the register,
   and privileged accounts to confirm.
5. Verify only what ISMS Copilot marks as unconfirmed or says it cannot confirm,
   against the official source text; list anything you cannot verify as "not
   verified".
6. Write YYYY-MM-DD-access-review.md to the output location: one table per
   system (account, finding, proposed action), a sign-off line for the approver
   in GRC.md section 6, and a "Verified" note. The last line is
   "Ran YYYY-MM-DD: N findings".

0 11 5 2,5,8,11 * cd /path/to/grc-repo && claude -p "$(cat prompts/access-review.txt)" --allowedTools "Read,Glob,Grep,Write,Bash(gh api:*),mcp__ismscopilot__list_workspaces,mcp__ismscopilot__create_conversation,mcp__ismscopilot__send_message,mcp__ismscopilot__get_reply" >> grc-reports/cron.log 2>&1

Run the risk register review. Do not edit the register.

1. Read GRC.md at the repository root, then the risk register it names in
   section 4. If GRC.md names a workspace, call list_workspaces to get its
   workspace_id. Read the previous risk review report in the output location, if
   any, and note its date.
2. List changes since that date that could affect risk: new or removed vendors,
   products, systems or locations, incidents, and changes to the policies and
   registers GRC.md points to (for example from git log on those paths). If a
   change was given to you by hand for this run, include it.
3. Call create_conversation once (answer_format "decision", mode fast,
   workspace_id if set). Send a short summary of the changes and the affected
   risk titles (not the whole register) and ask which new risks to consider and
   which existing risks may need rescoring or new treatment. Use send_message on
   the same conversation for follow-ups, polling get_reply until "complete"
   whenever a call returns status "generating".
4. Verify only what ISMS Copilot marks as unconfirmed or says it cannot confirm,
   against the official source text; list anything you cannot verify as "not
   verified".
5. Write YYYY-MM-DD-risk-review.md to the output location: changes considered,
   proposed new risks, proposed rescoring with the reason for each, each
   assigned to the risk approver in GRC.md section 6, and a "Verified" note.
   The last line is "Ran YYYY-MM-DD: N findings".

0 14 20 3,6,9,12 * cd /path/to/grc-repo && claude -p "$(cat prompts/risk-review.txt)" --allowedTools "Read,Glob,Grep,Write,Bash(git log:*),mcp__ismscopilot__list_workspaces,mcp__ismscopilot__create_conversation,mcp__ismscopilot__send_message,mcp__ismscopilot__get_reply" >> grc-reports/cron.log 2>&1

name: grc-document-staleness
on:
  schedule:
    - cron: "30 7 2 * *"   # 2nd of each month, 07:30 UTC
  workflow_dispatch: {}
permissions:
  contents: read
jobs:
  sweep:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - run: npm install -g @anthropic-ai/claude-code
      - name: Register ISMS Copilot MCP
        run: claude mcp add --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp --header "Authorization: Bearer $ISMS_COPILOT_TOKEN"
        env:
          ISMS_COPILOT_TOKEN: ${{ secrets.ISMS_COPILOT_TOKEN }}
      - name: Run the sweep
        run: |
          mkdir -p grc-reports
          claude -p "$(cat prompts/document-staleness.txt)" \
            --allowedTools "Read,Glob,Grep,Write,mcp__ismscopilot__list_workspaces,mcp__ismscopilot__list_documents,mcp__ismscopilot__create_conversation,mcp__ismscopilot__send_message,mcp__ismscopilot__get_reply"
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      - uses: actions/upload-artifact@v4
        with:
          name: grc-reports
          path: grc-reports/