What's New in Vanta 2.1.22
New year, new Vanta! Our resolution is to make managing security, undergoing an audit, and using Vanta easier than ever. To accomplish this, we’re focused on delivering platform updates in the following key areas:
- Transparent security
- Accelerated audit
- Enhanced configurability
You’ll see these themes play out more throughout the year in new feature releases and product improvements. Let’s jump right into these new categories with what’s new in Vanta this month.
Improved vulnerability management
One important area of our work is in providing an easier and more transparent way to manage vulnerabilities directly within Vanta. This month, we’ve completely reworked the Vulnerabilities page to deliver core usability improvements, including:
- A new Ignore Center to track and reopen previously ignored vulnerabilities
- A reworked SLA page to explain SLA violations or remediation reasons
- Export buttons to bulk download vulnerability data as a CSV file
- Vulnerability summary statistics to better understand your security posture
Vanta remains the only solution in our category to provide in-product vulnerability management. We integrate with best-in-class security tools, so that your team may more effectively and holistically manage vulnerabilities. These enhancements to our vulnerability tool deepen our commitment to continuous security and reinforce Vanta’s mission to restore trust in online businesses.
External task creation: Jira issues
Does your team live in Jira? If so, you’re in luck. Vanta now supports the creation of Jira Issues directly within test pages to better manage the distribution of security and compliance tasks with your broader organization. Gone are the days of playing telephone between Vanta and Jira to get work done.
Our growing collection of integrated task-tracking tools gives your team the flexibility to decide how to best incorporate Vanta into your team’s established workflows.
Custom evidence requests and control mapping
It’s not uncommon for an auditor to seek clarity on your organization’s security practices by requesting additional evidence. Further, if you’ve previously conducted an audit prior to using Vanta, it’s likely that your organization’s evidence exists in various locations outside of our platform. These factors often lead to prior and current evidence becoming scattered across communication channels, people, and even audit firms.
To better centralize evidence, we’re excited to announce that we’ve streamlined the evidence request process by making it easier for both auditors and customers to track custom evidence.
In seconds, auditors can request additional evidence from their clients directly within Vanta. Users are then notified via email of the evidence request along with any additional instruction the auditor may have provided. And because evidence requests are tied to specific controls in Vanta, custom evidence becomes mapped to your organization’s security framework and is reflected across all parts of Vanta like any other piece of important evidence.
Making the audit process as seamless and painless as possible is a core goal of ours, and we look forward to hearing how this new feature streamlines communication and evidence collection between your team and auditors.
Updated People page
People play an important role in maintaining the compliance and security status of their organizations. But the security profile of an individual greatly varies based on their employment status, degree of integration within a business, and responsibilities. To bring some clarity to this complex area of compliance, we’ve released several key updates to the People page.
We’ve introduced a new filtered view option on the People page, which enables you to view your people based on their security status, employment standing, group membership, or audit window. For group membership management, we’ve made it even easier to assign people to their groups with a new bulk assignment feature. And on the individual level, editing employee information can be done with a single click and new groups can now be created on the Settings pages.
Ensuring your people have the right access and training given their responsibilities and employment status is a critical part of any security framework, and we’re thrilled to empower Vanta users with the information they need to ensure their people are on the right track.
Tell us what you think
As always, we welcome your feedback on these changes! Please let us know what you think by reaching out to your Customer Success Manager. Let’s keep in touch on LinkedIn.
– The Vanta Team
PCI Compliance Selection Guide
Determine Your PCI Compliance Level
If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.
When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.
Answer a few short questions and we’ll help identify your compliance level.
Does your business offer services to customers who are interested in your level of PCI compliance?
Identify your PCI SAQ or ROC level
The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.
Good news! Vanta supports all of the following compliance levels:
A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.
Get PCI DSS certified
A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.
Learn more about eCommerce PCI
A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.
Use our PCI checklist
A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).
Automate your ROC and AOC