ICT Institute is now a Vanta partner: what users told us

At ICT Institute, we support customers with all kind of tooling: classic self-contained templates, Google Workspace, Notion and now Vanta. For our clients that work towards ISO 27001, we can now combine our hands-on ISMS advice (scoping, risk workshops, internal audits) with a compliance platform that takes a lot of the manual effort of collecting evidence and keeping controls alive throughout the year.

Vanta

Vanta is a web-based GRC platform that helps organisations manage compliance with frameworks like ISO 27001, SOC 2 and GDPR. It integrates the services and tools  you already use, such as identity providers and ticketing systems, and automatically fetches evidence of your running controls. On top of that, it a centralized place for documents, policies, and other libraries or management registers.

What users say

We took a deeper look of how Vanta works and interviewed several Vanta users directly and on specialized sub-reddits to see whether there is actual value. It was immediately clear that the cloud integrations genuinely save time. For example, Vanta can check you current MFA settings and status of your users and flag any drift as it happens instead of  manually screenshotting MFA settings or exporting user lists before an audit or planned check.

Another aspect that stood out  was the fit with small technical teams with no dedicated compliance person. This is indeed typical for many of our clients where teams that lacked dedicated compliance staff found Vanta made the process manageable. For instance, the continuous monitoring of controls efficacy, the planning tools and built-in reminders kept tasks alive because otherwise ‘compliance stuff’ would simply end up in the back log till the next audit.

Overall feedback from current users was positive, with emphasis on achieving ISO 27001 certification in several months. What is less positive is the price tag for some users, especially where some advanced add-ons are needed. Also, like any GRC platform, Vanta is not a silver bullet that takes away all your compliance work.

What Vanta does not replace

Vanta does not fully replace a real Information Security Officer or dedicated consultant. You still need real people to decide the ISMS scope, run a risk assessment workshop, or simply to make decisions. On top of pricing, the people we interviewed were also upfront about gaps in integration coverage (like on on-prem environments) and the fact that ISO 27001 still requires a proper internal audit, real risk treatment decisions, and a meaningful management review. For these, an experienced advisor makes the difference.

That is where we come in. We help clients scope their ISMS sensibly, deploy Vanta for the ISMS, run the workshops and training, and handle the internal audit. For teams aiming at a quick certification, this is the fastest but sensible approach without cutting the corners that can lead to failing the audit.

Talk to us

If you are considering ISO 27001 and wondering whether Vanta is a fit for your company, we are happy to have an informal chat whether or not you end up using the platform.