ALL RESOURCES
SOC 2
Key differentiators in security automation platforms: A series

Key differentiators in security automation platforms: A series

Part 1: A “documents” tab and recurring evidence tasks

Security certifications, while critical for your business’s survival and growth, can be truly cumbersome and pricey. All the time spent bringing your system up to the security standard you need to meet, investigating your security system to assess its readiness, preparing documentation, and more can add up to a major expense. It’s no surprise that there are several automated platforms on the market to simplify your security certifications.


These platforms aren’t created equal, though. So, how do you choose a security automation platform? What features should you look for and which features will make the largest difference? To answer those questions, we’re launching a special series about these key differentiators in security automation platforms and how each can save your organization time and money.


For our first article in the series, we’re covering two related features that make a powerful difference in your security audits: a “documents” tab and recurring evidence tasks.

What is a “documents” tab and why do you need it?

The purpose of a security automation platform is to automate as much of the security auditing process as possible. But there are parts of the process that can’t be automated - such as compiling and uploading certain documents of evidence for your auditor.


Whether you’re working toward your SOC 2, ISO 27001, or PCI compliance, for example, there will be several documents you’ll need to have available for your auditor. These can include policy documents, SLAs and contracts, evidence of certain security protocols, and so on. There’s no way to truly automate this, so most automation platforms simply don’t offer help for this task.


A “documents” tab in your automation software, though, gives you a place to upload all these documents so everything is in one place, stored safely and easily for you and your auditor to access. Not only does this make your team more organized, but it makes the auditing process faster, which saves you time and potentially money.

How does Vanta compare with other security automation platforms in compiling documents?

While most automation platforms don’t have a “documents” tab, Vanta does include this useful feature and we take it to the next level as well. First, Vanta provides you with a detailed list of all the documentation you need depending on the security certification you’re working toward.


Second, Vanta gives you a tab where you can upload all these documents in one concise place, making your preparation and your audit more time-efficient. This creates a single source of truth for both you and your auditor: something that most automation platforms do not provide.

Recurring tasks for evidence uploads

As helpful as it is to have a “documents'' tab, it’s important to understand that uploading your documentation isn’t a one-time task. There are certain documents or pieces of evidence you need to update on a regular basis to remain compliant. In some cases, missing an update to a compliance document can require you to go through the full auditing process again, rather than allowing you to go through a briefer recertification process.


That’s why recurring tasks can help with your evidence uploads. Ideally, you want your automation software to be able to automatically upload certain documents at specific intervals, like every quarter or every year. This way, the platform is helping you not only reach compliance but maintain it.

How does Vanta compare to other security automation platforms in upload recurrence?

Upload recurrence is not a feature you’ll find in most automation platforms - but you’ll find it in Vanta’s software. Vanta is able to automatically upload documents at the times you specify so your evidence stays up to date and is always ready for the next recertification. When Vanta uploads a new document of evidence, it changes this to the active document and stores the previous document for your records.


With most automation platforms, you don’t even have a place to upload all your documents, much less a way to automatically upload updated documents as needed. You’re left with relying on your memory or setting reminders in other tools like a calendar app, and then hoping that you see the reminders and have time to find and upload the right documents. Vanta takes that manual work out of your hands.


Read the series on key differentiators in security automation platforms

Part two: Automated employee offboarding and access management workflows

Part three: Security policy templates

Part four: Risk Assessment Register

Part five: Visibility into vulnerabilities

Written by
No items found.
Access Review Stage Content / Functionality
Across all stages
  • Easily create and save a new access review at a point in time
  • View detailed audit evidence of historical access reviews
Setup access review procedures
  • Define a global access review procedure that stakeholders can follow, ensuring consistency and mitigation of human error in reviews
  • Set your access review frequency (monthly, quarterly, etc.) and working period/deadlines
Consolidate account access data from systems
  • Integrate systems using dozens of pre-built integrations, or “connectors”. System account and HRIS data is pulled into Vanta.
  • Upcoming integrations include Zoom and Intercom (account access), and Personio (HRIS)
  • Upload access files from non-integrated systems
  • View and select systems in-scope for the review
Review, approve, and deny user access
  • Select the appropriate systems reviewer and due date
  • Get automatic notifications and reminders to systems reviewer of deadlines
  • Automatic flagging of “risky” employee accounts that have been terminated or switched departments
  • Intuitive interface to see all accounts with access, account accept/deny buttons, and notes section
  • Track progress of individual systems access reviews and see accounts that need to be removed or have access modified
  • Bulk sort, filter, and alter accounts based on account roles and employee title
Assign remediation tasks to system owners
  • Built-in remediation workflow for reviewers to request access changes and for admin to view and manage requests
  • Optional task tracker integration to create tickets for any access changes and provide visibility to the status of tickets and remediation
Verify changes to access
  • Focused view of accounts flagged for access changes for easy tracking and management
  • Automated evidence of remediation completion displayed for integrated systems
  • Manual evidence of remediation can be uploaded for non-integrated systems
Report and re-evaluate results
  • Auditor can log into Vanta to see history of all completed access reviews
  • Internals can see status of reviews in progress and also historical review detail

PCI Compliance Selection Guide

Determine Your PCI Compliance Level

If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.

When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.

Answer a few short questions and we’ll help identify your compliance level.

1
2
3
4
!
👍

Does your business offer services to customers who are interested in your level of PCI compliance?

Yes
No

Identify your PCI SAQ or ROC level

The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.

Good news! Vanta supports all of the following compliance levels:

SAQ A

A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.

Get PCI DSS certified

SAQ A-EP

A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.

Learn more about eCommerce PCI

SAQ D
for service providers

A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.

Use our PCI checklist

ROC
Level 1 for service providers

A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).

Automate your ROC and AOC

Download this checklist for easy reference

Questions?

Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.

The compliance news you need. Delivered securely to your inbox.