ISO27001 (the main security one) has annual reviews which are more lightweight. After two years, the three-year cycle restarts.