Key differentiators in security automation platforms: A series
Part 1: A “documents” tab and recurring evidence tasks
Security certifications, while critical for your business’s survival and growth, can be truly cumbersome and pricey. All the time spent bringing your system up to the security standard you need to meet, investigating your security system to assess its readiness, preparing documentation, and more can add up to a major expense. It’s no surprise that there are several automated platforms on the market to simplify your security certifications.
These platforms aren’t created equal, though. So, how do you choose a security automation platform? What features should you look for and which features will make the largest difference? To answer those questions, we’re launching a special series about these key differentiators in security automation platforms and how each can save your organization time and money.
For our first article in the series, we’re covering two related features that make a powerful difference in your security audits: a “documents” tab and recurring evidence tasks.
What is a “documents” tab and why do you need it?
The purpose of a security automation platform is to automate as much of the security auditing process as possible. But there are parts of the process that can’t be automated - such as compiling and uploading certain documents of evidence for your auditor.
Whether you’re working toward your SOC 2, ISO 27001, or PCI compliance, for example, there will be several documents you’ll need to have available for your auditor. These can include policy documents, SLAs and contracts, evidence of certain security protocols, and so on. There’s no way to truly automate this, so most automation platforms simply don’t offer help for this task.
A “documents” tab in your automation software, though, gives you a place to upload all these documents so everything is in one place, stored safely and easily for you and your auditor to access. Not only does this make your team more organized, but it makes the auditing process faster, which saves you time and potentially money.
How does Vanta compare with other security automation platforms in compiling documents?
While most automation platforms don’t have a “documents” tab, Vanta does include this useful feature and we take it to the next level as well. First, Vanta provides you with a detailed list of all the documentation you need depending on the security certification you’re working toward.
Second, Vanta gives you a tab where you can upload all these documents in one concise place, making your preparation and your audit more time-efficient. This creates a single source of truth for both you and your auditor: something that most automation platforms do not provide.
Recurring tasks for evidence uploads
As helpful as it is to have a “documents'' tab, it’s important to understand that uploading your documentation isn’t a one-time task. There are certain documents or pieces of evidence you need to update on a regular basis to remain compliant. In some cases, missing an update to a compliance document can require you to go through the full auditing process again, rather than allowing you to go through a briefer recertification process.
That’s why recurring tasks can help with your evidence uploads. Ideally, you want your automation software to be able to automatically upload certain documents at specific intervals, like every quarter or every year. This way, the platform is helping you not only reach compliance but maintain it.
How does Vanta compare to other security automation platforms in upload recurrence?
Upload recurrence is not a feature you’ll find in most automation platforms - but you’ll find it in Vanta’s software. Vanta is able to automatically upload documents at the times you specify so your evidence stays up to date and is always ready for the next recertification. When Vanta uploads a new document of evidence, it changes this to the active document and stores the previous document for your records.
With most automation platforms, you don’t even have a place to upload all your documents, much less a way to automatically upload updated documents as needed. You’re left with relying on your memory or setting reminders in other tools like a calendar app, and then hoping that you see the reminders and have time to find and upload the right documents. Vanta takes that manual work out of your hands.
Read the series on key differentiators in security automation platforms
PCI Compliance Selection Guide
Determine Your PCI Compliance Level
If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.
When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.
Answer a few short questions and we’ll help identify your compliance level.
Does your business offer services to customers who are interested in your level of PCI compliance?
Identify your PCI SAQ or ROC level
The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.
Good news! Vanta supports all of the following compliance levels:
A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.
Get PCI DSS certified
A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.
Learn more about eCommerce PCI
A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.
Use our PCI checklist
A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).
Automate your ROC and AOC