how do I keep the data in my file up to date

Keeping current means updating source data, not updating lists

A chain file remains current if you update it at the moment an underlying data point changes, not at the moment another questionnaire arrives. This saves effort: instead of going through dozens of questionnaires, you maintain a limited number of source data — identity, size, locations, certificates, policies — and these automatically feed every answer that depends on them. In practical terms, this means a change in the number of employees or in the countries where the undertaking has establishments needs to be adjusted in only one place, after which that change takes effect in every answer that uses that data point.

The data that becomes outdated fastest is no accident: size (employees, turnover) changes annually through the annual accounts, certificates have an expiration date and expire, and policy documents — a continuity plan, an information security policy — are reviewed periodically. Regular checks at the annual accounts and at each certificate renewal covers most of the changes. In CSRD reporting according to the VSME baseline module or in the ten measures of Article 21(2) of the NIS2 Directive, the underlying data point is often a policy document with a version number and a date; these two are the simplest indicator of whether an answer is still correct, regardless of whether the process itself has changed substantively.

Companies Act and Annex A of ISO/IEC 27001 as anchors

Two sources show why current status is a structural characteristic of the file, not a one-time action. The Companies Act 2007 requires undertakings to notify changes in registered data, and that register is for identity data — the registered name and the registration number — the most reliable source to check against periodically. Annex A of ISO/IEC 27001 works with control measures that must be demonstrably kept current, including evaluation dates; a file that adopts those evaluation dates does not need to determine itself when a measure is due for review.