Compliance calendar software: an annual compliance calendar app for SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS deadlines

Compliance calendar software schedules every recurring compliance obligation, assigns each one to a named owner, and reminds that owner before the due date. Unlike a shared calendar, it records who completed each task, when, and the evidence, then schedules the next cycle. Complies does this for SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS from $79 a month billed yearly.

A compliance calendar is a dated schedule of every recurring compliance task a company owes: access reviews, policy reviews, vendor re-assessments, risk assessments, training, filings and audit windows. Each entry should carry an owner, a frequency and a due date. It exists because most compliance failures are missed dates rather than missing intent.

List every obligation from the frameworks, contracts and regulations that apply to you, give each one a frequency and a named owner, and set the first due date. Then decide how owners will be reminded and where proof of completion will be kept. A tool that seeds the recurring obligations from your framework removes most of the first step.

Each entry needs the obligation, the requirement it satisfies, a named owner, a frequency, the next due date, a status and a link to the evidence. For a SOC 2 or ISO 27001 program that usually means quarterly access reviews, annual policy approvals, an annual risk assessment, vendor reviews, security awareness training, backup restore tests and the audit window itself.

An annual compliance calendar lays out a full year of recurring compliance deadlines so the workload is visible in advance: which quarter carries the access reviews, when the policy approvals and risk assessment fall, and how far the audit window sits from them. Spreading yearly tasks across the year, instead of stacking them before the audit, is the main reason to build one.

Yes. Complies publishes each workspace calendar as a private iCalendar feed, which Google Calendar adds under Other calendars, From URL, and Outlook adds as an internet calendar subscription. The feed lists obligation due dates and, on Growth and Scale, evidence refreshes and vendor reviews. Calendar apps refresh subscriptions on their own schedule, so allow a few hours for changes.

Complies runs in the browser rather than as a native mobile app. Owners get email reminders on any device, and the iCalendar feed puts every due date into the calendar app already on their phone, so nobody needs to install anything to see what is due this week.

Complies publishes its prices: $79 a month billed yearly for Starter, $199 for Growth and $499 for Scale, or $95, $239 and $599 billed monthly. The EHS calendar vendors we checked in September 2026, Benchmark Gensuite and Ecesis, publish no prices, and security automation platforms such as Vanta and Drata are quote-only with Vendr medians near $20,000 to $25,000 a year.

SOC 2 rarely prescribes frequencies. It asks that controls operate consistently, and auditors test that over the observation period. In practice teams schedule user access reviews quarterly, an annual risk assessment, annual policy review and approval, periodic vendor reviews under CC9.2, security awareness training at least yearly, and incident response and backup restore tests at least once a year.

Quarterly is the common default. PCI DSS 4.0.1 requirement 7.2.4 sets a hard minimum of once every six months for all user accounts. SOC 2 CC6.2 says periodic and ISO 27001 A.5.18 says regular intervals, so the auditor judges your stated frequency against your risk, and the HIPAA Security Rule names no interval at all.

A checklist says what must be true; a calendar says when each recurring piece of work is due and who owes it. A checklist is used once to get ready for an audit, while a calendar keeps you ready afterward, because most controls repeat. You need both, and in Complies the checklist items that repeat become calendar tasks.

It depends on where your deadlines come from. If they come from OSHA, the EPA, state environmental permits or DOT/PHMSA, you need an EHS compliance calendar such as Benchmark Gensuite or Ecesis. If they come from SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS and customer security clauses, you need a security compliance calendar, which is what Complies is.