IM8 compliance without the spreadsheet chase

If you look after compliance for a Singapore government supplier or a public-sector organisation, you probably know the pattern. An audit date appears in the calendar, and the next few weeks disappear into spreadsheets, shared folders and email threads, chasing screenshots, policy versions and sign-offs that were "definitely done" months ago.

IM8, the Singapore Government's instruction manual for ICT and smart systems management, is rarely the only obligation on the list. Many teams also answer to ISO 27001, keep continuity plans in line with ISO 22301, and increasingly have to show how operational technology is protected. Each framework brings its own wording, its own evidence requests and often its own spreadsheet.

Why IM8 compliance turns into a chase

The problem is rarely a lack of effort. It is usually structural:

• Evidence is collected after the fact. Work happens throughout the year, but proof of it is gathered in a rush before each audit. By then, people have moved on and records are incomplete.
• The same control is assessed several times. Access control, logging or change management appear in IM8, ISO 27001 and other frameworks under different names. Without a shared view, teams answer essentially the same question again and again.
• Risk is assessed once a year. A point-in-time assessment goes stale the day it is signed. New vulnerabilities, configuration changes and ageing systems accumulate unseen until the next review.
• Know-how lives in a few heads. Framework expertise is scarce. When one or two people hold the mapping between requirements and evidence, every audit depends on their availability.

A practical approach

None of the following requires a particular product. It is a way of organising the work so that audits become a review of what already exists, rather than a project.

1. Build one control library and map it across frameworks

Start from a single set of controls that your organisation actually operates, then map each one to the IM8, ISO 27001 and other requirements it satisfies. When the access review is done, it counts everywhere it is relevant. The aim is simple: assess a control once and reuse the evidence.

2. Capture evidence at the moment of work

Evidence is cheapest when it is recorded as part of the task: the approval on the change request, the completed recurring check, the updated asset record. Tie each piece of evidence to the control it supports and to a named owner, so nobody needs to reconstruct it later.

3. Give every recurring task an owner and a date

Many findings come from routine activities that quietly slip: quarterly reviews, plan tests, access recertifications. A compliance calendar with clear responsible and accountable owners (a RACI) turns these into visible, trackable tasks rather than things remembered just before the audit.

4. Keep a living risk register

Link risks to real assets, threats, vulnerabilities and the controls that reduce them, and re-assess when something changes rather than once a year. A register that an auditor can follow from asset to threat to control to residual risk is far easier to defend than ratings that rest on opinion.

5. Control change formally

Auditors want to see that material changes are approved by someone other than the requester and that the decision is recorded. A defined change workflow with dual approval and segregation of duties produces that record automatically.

Where NormSentry fits

NormSentry is Evelcra's governance, risk and compliance platform. It was built around the approach above, with risk assessment at its core.

• IM8 supported natively. NormSentry includes an IM8 framework pack with 102 controls, alongside ISO 27001, ISO 22301, IEC 62443, NIST, PCI DSS, NIS2 and DORA, on one universal control schema of 1,068 controls in total.
• Map once, satisfy many. The multi-framework crosswalk lets you assess a control once and reuse the evidence across every framework that needs it, with per-framework posture cards showing implementation status.
• Continuous, traceable risk. A five-stage risk engine (impact, likelihood, inherent risk, residual risk and tolerance) re-runs on change or on a schedule. Every score is traceable to the threats, controls and assumptions behind it, and results are held in a durable risk register.
• Governance built in. Change Request Forms with four-eyes approval, an approval matrix, segregation-of-duties rules, RBAC, RACI ownership and a full audit trail.
• A compliance calendar. Recurring, RACI-routed cadence tasks so routine controls do not slip between audits.
• Auditor access to live posture. Auditors can be given their own read-only account to review evidence-backed posture directly, instead of exported binders.
• Data residency. NormSentry is built and hosted on Singapore cloud, or can be deployed fully on-premise.

NormSentry and NflowX are deployed in Singapore government-related and critical-infrastructure programmes, supporting frameworks such as IM8, ISO 27001 and IEC 62443.

A simple first step

Before buying anything, try a short exercise. List the frameworks you answer to, pick ten controls that appear in more than one of them, and count how many times each is assessed and evidenced separately each year. That number usually makes the case for a single control library on its own.

If you would like to see how this works on your own estate, request a NormSentry demo. If you are an MSSP or consultancy supporting public-sector clients, find out about partnering with Evelcra.