Compliance

screenPatterns:
Misc
Progress
Browse & Discover

screenPatterns: Dashboard Charts

screenElements:
Avatar
Grid List
Card
Thumbnail
Progress Indicator
Tree
Top Navigation Bar
Logo
Icon
Side Navigation
Progress Indicator

screenPatterns:
Dashboard
Charts
Misc
Misc
Timeline & History
Misc
Progress
Browse & Discover
Misc
Home
Progress

screenKeywords:
Vanta ® # & (N
Q Help... #+K Controls More
@ Home
= Tests Assignment Completion
[ Reports -
0 ) ; 100 Controls OK Test (2 132133
a . nassigne:
I Compliance g 99% o—— 9%
0,
4 /o ® Assigned 4
Frameworks .
Assigned | Document @ 37/38
® .
Controls Needs reassignment 0 103 controls 104 total LA
Policies
Documents . i o
Q' Search controls Framework v Owner v Domain v Source v Framework code v Status v Trust Center v Risk v =
Audits
D ® Control Owner Source Frameworks Tests
@ Trust Center
@ Risk Asset disposal procedures utilized ) SOC2-CC6.5
AST-1 The company has electronic media containing confidential Unassigned Vanta s 9 2/2
,é, Vendor information purged or destroyed in accordance with best practices,...
= Assets Data retention procedures established SOC2-CC5.3
AST-2 The company has formal retention and disposal procedures in place Unassigned Vanta 9 2/2
22 Personnel to guide the secure retention and disposal of company and custom... S0C2-CC65 +2
M . Production inventory maintained
¥ Integrations AST-3 The company maintains a formal inventory of production system Unassigned Vanta SO0C2-cC61 933
assets.
Continuity and Disaster Recovery plans established
BCD-1 The company has Business Continuity and Disaster Recovery Plans Unassigned Vanta SOC2-CcC9l 9 2/2
in place that outline communication plans in order to maintain...
Continuity and disaster recovery plans tested . SOC2-CC3.2
BCD-2 The company has a documented business continuity/disaster Unassigned Vanta @ 3/3
€l recovery (BC/DR) plan and tests it at least annually. S0C2-CC75
|Vanta ® ® @& (N
Policies More v
@ Home
Q Framework v Status v Type v Require my approval Sort by Recommended order v N =
Y= Tests
(1) Reports Name Frameworks Status Last approved on Personnel acceptance ®
I Compliance Code of Conduct soc 2 © 0K Apr 30, 2024 © 46/46
Frameworks
Information Security Policy (AUP) SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Controls
Policies Informatl.orls.ecurlty Roles and — © oK Apr 30, 2024 © 26/46
Responsibilities
Documents
Audits Asset Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Trust Center
Access Control Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Risk
& Vendor Data Management Policy SoC 2 © OK Apr 30, 2024 @ 46/46
= Assets
Operations Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
22 Personnel
" i Human Resource Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
¢ Integrations
Physical Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Risk Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
<l Third-Party Management Policy SOC 2 QoK May 2, 2024 @ 46/46
|Vanta ® ® @& (N
Q Help... #+K A
: . Audits
S e Active  Completed
Y= Tests
Q Search Audit firm v Framework v Status v
[ Reports
I Compliance .
SOC 2 Type Il Audit & Awaiting report Openaudit -
Frameworks @
& Auditing ACME LLP RC CS KC MB +6
Controls
Policies ) Auditor gets access May 9, 2024 Audit progress
D 1 c_________________________________________________________________[ J
ocuments
b9 Audit starts May 9, 2024 ) )
® Not ready for audit 1 ® Flagged by auditor 0
Audits
L) Audit ends August 9, 2024 ® Ready for audit 185 ® Accepted 0
@ Trust Center
® Not applicable 9
[ Risk
& Vend
s vendor E No reports available yet
= Assets
22 Personnel
U Integrations @ S0OC2 Type Il Audit = Awaiting report Open audit
& Auditing ACME LLP JA
L) Auditor gets access May 9, 2024 Audit progress
c___________________________________________________________________[ )
b9 Audit starts May 9, 2024 ) )
® Not ready for audit 1 ® Flagged by auditor 0
<l L) Audit ends August 9, 2024 ® Ready for audit 185 ® Accepted 0
|Vanta ® ® @& (N
Frameworks View audits
@ Home All
Y= Tests
Q
[ Reports
| & complance ) ISO 27001:2022
s ISO 27001:2013
Global benchmark to
o Global benchmark to demonstrate an elective
SOC 2 demonstrate an elective Information Security
B Information Security Management System (ISMS).
Policies Management System (ISMS). For businesses selling to
For businesses selling to customers outside of the US.
Documents customers outside of the US. Includes 2022 version revisions
and updates.
Audits
@ Trust Center
‘ ’ 96% ) 44% Schedule a call \ 31% Schedule a call
@ Risk
& Vendor
= Assets GDPR 1ISO 42001
%® Personnel ISO 42001 defines the
. . European Union (EU) regulation requirements for establishing,
g:(':tjri ?:tra;it(g:mea%:auon @ to protect personal data and implementing, maintaining and
¥ Integrations Information (PHI). For US privacy of its citizens. For all continually improving an Al
e .rocess companies that do business or management system for the
transpmit et storg PHI da'ta have employees located in the responsible development,
! . EU. provision and use of Al
systems.
\ 34% Schedule a call J 62% Schedule a call \ 34% Schedule a call
€|
|Vanta ® ® @& (N
25 LG L3 Documents: All ¥ Export all Add document v
@ Home
earch all documents atus v ubcategory v requency v ramewor v riority v =
CATEGORY Qs halld t Stat Subcategory Freq y F k (1) Priority =
Y= Tests
All Owner v Time Sensitivity v Clear
Reports
W Rep HR
. N IT C] Name Frameworks Category Owner Status Due date
Compliance
Policy Human
Proof of completed access
[FETEELE O A P SoC 2 resources JL © Needs document & Sep2
Engineering review
Account setup
Controls
Risks Human
Policies Cust O Contractor agreement soc 2 resources JL A Needs update @ Oct 8,
ustom
Employees
Documents
4 DEACTIVATED 0O Public change log or release — Engineering e ® ok .
Audits notes Software develop...
All deactivated
@ Trust Center O Customer support site or email — Engineering i © oK B
. alias Software develop...
@ Risk
- Engineerin
& Vendor @) Application status page SOC 2 9 9 JT © OK —
Software develop...
Saplss Publicly available pri Poli
ublicly available privac
O — privacy soc 2 olicy o © oK —
22 Personnel policy Policies
. ) 0O PubI!cIy available terms of — Policy e ® oK .
¢ Integrations service Policies
. . Polic
O Cookie Policy soc 2 licy JT © 0K —
Policies
0O Employee termination security — Policy e ® oK .
policy Policies
. i Engineerin
@) Product documentation site SOC 2 9 9 JT © OK —
€| Software develop...
|Vanta ® ® @& (N
<Ll s Home @ View tasks
I @ Home .
Compliance progress Last updated less than a minute ago
Y= Tests
[ Reports SOC 2 >
i )
Compliance 99/0
@ Trust Center D
103 controls complete 104 total
[J Risk P
& Vendor
= Assets Monitoring
22 Personnel .
= Policies > L Tests >
¥ Integrations Needs attention ® Needs attention ®
. D
15 OK 15 total 141 OK 148 total
© Vendors > [0 Documents >
Needs attention ® Needs attention ®
. D
46 OK 46 total 37 OK 39 total
€|
|Vanta ® ® @& (N
Frameworks View audits
@ Home All
Y= Tests
Q
[ Reports
T e , ISO 27001:2022
menore ISO 27001:2013
Global benchmark to
Controls Global benchmark to demonstrate an elective
sm 2 View requirements > demonstrate an elective Information Security
B Information Security Management System (ISMS).
Policies Management System (ISMS). For businesses selling to
For businesses selling to customers outside of the US.
Documents customers outside of the US. Includes 2022 version revisions
and updates.
Audits
@ Trust Center
O 929% ) 46% Schedule a call \ 34% Schedule a call
@ Risk
& Vendor
& Assets GDPR ISO 42001
%t Personnel ISO 42001 defines the
. . European Union (EU) regulation requirements for establishing,
g:étjri itraotte;sct(g:%_l;ea%hlatlon ® to protect personal data and implementing, maintaining and
¥ Integrations Information (PHI). For US privacy of its citizens. For all continually improving an Al
e .rocess companies that do business or management system for the
transpmit o storg PHI da'ta have employees located in the responsible development,
! . EU. provision and use of Al
systems.
3 37% Schedule a call J 63% Schedule a call \ 34% Schedule a call
€l
|Vanta ® ® @& (N
25 LG L3 Documents: All ¥ Export all Add document v
@ Home
CATEGORY Q Search all documents Status v Subcategory v Frequency v Framework (1) v Priority v =
Y= Tests
All Owner v Time Sensitivity v Clear
Reports
W Rep HR
. N IT C] Frameworks Category Owner Status Due date 1
Compliance
Frameworks Policy completed access Human
O P SoC 2 resources JL © Needs document & Sep 2, 2024
Engineering
Controls Account setup
Risks Human
Policies Cust C] or agreement SOC 2 resources JL A Needs update M Oct 8, 2024
ustom
Employees
Documents
DEACTIVATED 1ange log or release Engineering
" SOC 2 JT OK -
Audits a Software develop... °
All deactivated
@ Trust Center 0O r support site or email — Engineering e ® oK .
. Software develop...
@ Risk
Engineerin
£ Vendor () on status page soc 2 9 9 JT © 0K —
Software develop...
S Assets available privac Poli
O privacy soc 2 olicy o © oK —
22 Personnel Policies
. ) 0O available terms of — Policy e ® oK .
¢ Integrations Policies
O olicy soc 2 Policy o © oK —
Policies
L - . .
O ? termination security — Policy e ® oK .
Policies
. i Engineerin
() documentation site SOC 2 9 9 JT Q@ OK —
€| Software develop...
|Vanta ® ® @& (N
Audits
@ Home Active  Completed
Y= Tests
Q Audit firm v Framework v
[ Reports
I Compliance
S
©

Frameworks

Controls Add your first audit

Policies

Unsure about the audit details? Grant auditor access to add it for you Initiate the audit yourself with control on audit dates & access
Documents
Manage audit firm access Add audit

Audits
@ Trust Center
@ Risk
& Vendor
= Assets
22 Personnel
¥ Integrations

€l


Integrations

appName: Vanta

appCategory: Business

appTagline: Automate compliance, manage risk, and prove trust

companyHqRegion: US & Canada

companyStage: Growth Stage

platform: web

pageType: Application

screenPatterns: Home Progress

screenElements:
Stacked List
Thumbnail

screenElements:
Stacked List
Thumbnail
Top Navigation Bar
Logo
Icon
Side Navigation
Progress Indicator

pageType: Application Application

screenKeywords:
Vanta ® ® @& (N
|ntegrati0ns ® Missing an integration? Let us know! (%
Review your integrations and enable new connections to activate automated evidence collection and monitoring. Vanta
@ Home scans your infrastructure from a known IP address in case an allowlist is required.
L Connected (18)  Available (329)
[ Reports
CATEGORIES Q Integration capability v & Apply user scope
Compliance All
@ Trust Center Cloud providers Ashby @ Connected
@ Risk Communication platforms Other Configure scope
Access
Overview HRIS
. . Identity providers
Risk register
Observability
Risk library Amazon Web Services (AWS) @ Connected
Other aAWS cloud i i il "
providers e Version control systems ¢ Other « Vulnerability scanners Configure scope
Action tracker ~~—-1 9 p
Task management Access Inventory Vulnerabilities
Snapshots .
Version control systems
Settings Vulnerability scanners
& Vendor Cloudflare @ Connected
COLLECTIONS é: Other Configure scope
= Assets A
Built by Vanta ccess Inventory
22 Personnel Beta
I ¥ Integrations
A 4 people found in your HR system could not be matched to accounts in Vanta View HR data
Either manually connect them to existing accounts in Vanta, create a new Vanta account for
them, or do not monitor them by marking them as 'out of scope'
<l Deel @ Connected
.I huoic i~ e
|Vanta ® ® @& (N
<Ll s Home @ View tasks
I @ Home .
Compliance progress Last updated less than a minute ago
Y= Tests
[ Reports SOC 2 >
i )
Compliance 99/0
@ Trust Center D
103 controls complete 104 total
[J Risk P
& Vendor
= Assets Monitoring
22 Personnel .
= Policies > L Tests >
¥ Integrations Needs attention ® Needs attention ®
. D
15 OK 15 total 141 OK 148 total
© Vendors > [0 Documents >
Needs attention ® Needs attention ®
. D
46 OK 46 total 37 OK 39 total
€|


Turning off haptics

appName: (Not Boring) Vibes

appCategory: Health & Fitness

appTagline: Music to focus, sleep, & relax

companyStage: Bootstrapped & Indie

platform: ios

hotspotType: Tap

screenElements:
Bottom Sheet
Icon

screenKeywords:
9:41 wll T @m)
[am———
VIBES X
AA  RHYTHM
! ACHIEVEMENTS
22 HAPTICS .
7O> KEEP SCREEN ON .
M ouick cuIpe
SUPER ! BORING
. MEMBERSHIP SUPER
. APP ICON GRAPHITE
= ADD A WIDGET
* WALLPAPERS
APPS
7 & ~
e e SV
|9:41 ull T =)
[ARR————————
VIBES X
AA  RHYTHM
' ACHIEVEMENTS
22 HAPTICS .
7O> KEEP SCREEN ON .
M ouick cuIpe
SUPER ! BORING
. MEMBERSHIP SUPER
. APP ICON GRAPHITE
= ADD A WIDGET
* WALLPAPERS
APPS
7 & ~
S ————
|9:41 ull T =)
[
VIBES X
AA  RHYTHM
! ACHIEVEMENTS
22 HAPTICS ‘
“@> KEEP SCREEN ON .
M ouick cuIpe
SUPER ! BORING
. MEMBERSHIP SUPER
. APP ICON GRAPHITE
= ADD A WIDGET
* WALLPAPERS
APPS
7 & ~
S ———


Switching to Relax focus

screenKeywords:
9:41 all T -
FIND YOUR FLOW WITH NO DISTRACTIONS
RISE FOCUS = W96
SLEEP i (0AV/=
o
)8 >
L——————————— 3
|(o R all © @8
[ [[]]
(3]
00 8 1 =S 0 U I = 2 I I o 401 U1 S v W [ ]
ﬂ RELAX
\\://
|9:41 oll T @)
e O
(>
: N |
\ \CD Id' !
I ¢
@ RELAX


Add a control

screenKeywords:
Add document to control X
Q_ Search controls Framework v
CONTROLS . .
Asset disposal procedures utilized
Asset disposal procedures utilized &
Data retention procedures established
Description
Lo s The company has electronic media containing confidential information purged or
Production inventory maintained destroyed in accordance with best practices, and certificates of destruction are
issued for each device destroyed.
Continuity and Disaster Recovery plans established Domain
Asset Management
Continuity and disaster recovery plans tested
Frameworks
o o sOoC 2
Cybersecurity insurance maintained
Related sections
Configuration management system established CC 6.5 c12
Change management procedures enforced
|Vanta ® ® @& (N
Subscribers ®
@ Home X
Y= Tests
[ Reports
I Compliance v Related frameworks and controls + Add control
Frameworks
FRAMEWORK SECTION CODE CONTROL OWNER
Controls
Policies SOC 2 CC6.2-CC63-CC6.4 Access reviews conducted Unassigned =®R
Documents
Audits
@ Trust Center Tasks
@ Risk .
GitHub (0)  Notion (0)
& Vendor
- To create and see GitHub issues here, please grant write access
= Assets
22 Personnel Grant write access
¥ Integrations
> Related audits
€l


Vendor

screenElements:
Top Navigation Bar
Logo
Icon
Side Navigation
Progress Indicator

screenPatterns: Home Progress Misc Misc

pageType: Application Application Application

screenKeywords:
Vanta ® ® @& (N
<Ll s Home @ View tasks
I @ Home .
Compliance progress Last updated less than a minute ago
Y= Tests
[ Reports SOC 2 >
i )
Compliance 99/0
@ Trust Center D
103 controls complete 104 total
[J Risk P
& Vendor
= Assets Monitoring
22 Personnel .
= Policies > L Tests >
¥ Integrations Needs attention ® Needs attention ®
. D
15 OK 15 total 141 OK 148 total
© Vendors > [0 Documents >
Needs attention ® Needs attention ®
. D
46 OK 46 total 37 OK 39 total
€|
|Vanta ® ® @& (N
Q Help... #B+K .
Active 46 Archived
@ Home
Q Search vendors Category v Inherent risk v Security owner v Data agreement v Review status v &) Review due date v =
Y= Tests
Reports
W P Name / Category Inherent Risk Data Agreements ® Security Review Last Reviewed
Compliance aws Amazon Web Services A High - o Up to date May 2, 2024
" Cloud provider Due May 2, 2025 '
@ Trust Center
2 Apple Business Manager . .
. Medium — Not required —
[ Risk « Other & e 9
S V
& Vendor
I ? © Medium — @ Not required -
= Assets
Inventory ? © Medium — @ Not required -
Vulnerabilities
’ © Medium - @ Not required —
Settings
22 Personnel =] i — i —
v © Medium @ Not required
U Integrations
v 9 ’ © Medium — @ Not required —
L ~ High — @ Uptodate Jun 5, 2024
Due Jun 5, 2025
- ~ High — @ Uptodate May 2, 2024
Due May 2, 2025
™ A High — Up to date May 2, 2024
a g ° Due May 2, 2025 v
[ ] ~ High - Up to date May 14, 2024
€l H g O May 14, 2025 M
|Vanta ® ® @& (N
Vendors ¥ Export data Settings v
@ Home
= Tests x
(L) Reports Sompe S s G s . 0 voan | | @ v | [ oo
PO e AT S o GiHs
@D incudethis category i sk scoring calculaion il “ el
Compliance o
T e [ Vo Proactively manage third-party risk
@ Trust Center . B Gz oiscovery
) ] DT et e Move on from tedious and point-in-time vendor reviews. Vanta's
o e Vendor Risk Management solution lets you automate vendor
I & Vendor N a ot (o) () [k discovery, risk assessment, and remediation so you can spend
- - e . e o less time on vendor reviews and more time strengthening your
g Assets Iosdmbgiien - " 2 @ A
- . oy R . security posture.
Inventory . S == © [ e—
e Ao © [ Schedule a call
Vulnerabilities - Ol | Bisecni
pye o
ettings : ‘ ; N . G
.o e Lom v 6 em N
202 Personnel Gy e " ,
¥ Integrations
Active 46 Archived
Q Category v Inherent risk v Security owner v Data agreement v Review status v 9 Review due date v =
Name / Category Inherent Risk Data Agreements ® Security Review Last Reviewed
Amazon Web Services h Up to date
aws , ~ High — o F May 2, 2024
Cloud provider Due May 2, 2025
Apple Business Manager . .
€| .' pp 9 © Medium — @ Not required —
Other


Adding a task

screenPatterns:
Add & Create
Goal & Task

pageType: Application Application Application Application Application Application Application Application Application Application

screenKeywords:
Vanta p Risk management Risk register More v Create snapshot
Review all of the risks that have been identified for your business. For each risk, review and describe the
ASSESSMENT risk treatment plan.
Finish Starter Guide Register (0)
— Library
12/20 tasks completed
Action tracker Getting started with your risk management View guided tours X
0 out of 5 completed

Q Go to... #+K Settings P
OVERVIEW ~
Home Inherent risk Residual risk
Tests

5 5
COMPLIANCE ~
Frameworks Low Low

- ®0 - ®0
Controls § §

£ Med £ Med
Policies - ©0 - ©0
Documents High High

1 20 1 =0
TRUST ~ 1 Likelihood 5 1 Likelihood 5
Trust Report
Questionnaires @
RISK ~ Q Owner v Categories v CIA Categories v Source v m
Risk management
Access You don't have any risks

Start with the Identify Risk section above.
Vendors
Vulnerabilities
®

ORGANIZATION ~
|Add task X
Risk scenario

Company data is breached due to human error and/or misunderstanding of co... v
Description

Example data breach|
Note Optional
Due date

9 Oct 16, 2023
Assign to

® Select v
|vanta < Riskmanagement  Action tracker
Tasks and controls associated with approved risk scenarios are tracked here.
ASSESSMENT
Finish Starter Guide Register (0)
Tasks  Controls
_——— Library e
12/20 tasks completed
Action tracker Assignee v Show complete tasks Add task + v Download CSV
Q Go to... $+K Settings
R < You don't have any tasks
Tasks are things you want to do to mitigate, transfer, or avoid a risk scenario. You can create a task when
Home reviewing a risk scenario.
Tests
COMPLIANCE ~
Frameworks
Controls
Policies
Documents
TRUST ~
Trust Report
Questionnaires @
RISK ¥
Risk management
Vendors
Vulnerabilities
®
ORGANIZATION ~
|Add task X
Risk scenario
Company data is breached due to human error and/or misunderstanding of co... v
Description
Example data breach
Note Optional
Search...
v X Remove assignee
Jane Smith Admin
Jon Smith
® Select v
|Add task X
Risk scenario

Company data is breached due to human error and/or misunderstanding of co... v
Description

Example data breach
Note Optional
Due date

9 Oct 16, 2023
Assign to

® Jane Smith v
|Add task X
Risk scenario

Select a risk scenario v
Description
Note Optional
Due date

9 Oct 16,2023
Assign to

® Select v

Cancel Create task
|Add task X
Risk scenario
Company data is breached due to human error and/or misunderstanding of co... v
Description
10 16 @ 23
Example data bre:
Note Optional
< October 2023 >
Due date Su Mo Tu We Th Fr Sa
9 Oct 16, 2023 1 2 3 4 5 6 7
Assign to 8 9 10 11 12 13 14
© sSelect v 15 17 18 19 20 21
22 23 24 25 26 27 28
|vanta <« Risk management Action tracker
Tasks and controls associated with approved risk scenarios are tracked here.
ASSESSMENT
Finish Starter Guide Register (0)
Tasks  Controls
_—— Library —_—
12/20 tasks completed
Action tracker Q Assignee v Show complete tasks Add task + 4 Download CSV
Q Goto... #+K Settings
TASK ASSIGNEE STATUS FILES RISK SCENARIO NOTE

OVERVIEW ~

Home Company data is
breached due to

Tests human error

Ej)a(??ggach Jane Smith ) and/or Mark as compl...

misunderstandin

COMPLIANCE ~ of company
requirements.

Frameworks

Controls 1-1 of 1 result Show 20 v results per page Previous Next

Policies

Documents

TRUST ~

Trust Report

Questionnaires

RISK ¥

Risk management

Vendors

Vulnerabilities

Successfully created task ®
ORGANIZATION ~
|Add task X
Risk scenario

Select a risk scenario v

[Search...

Company data is breached due to human error a...

Note Optional
Due date

9 Oct 16, 2023
Assign to

® Select v

Cancel Create task
|Add task X
Risk scenario

Company data is breached due to human error and/or misunderstanding of co... v
Description
Note Optional
Due date

9 Oct 16, 2023
Assign to

® Select v


Assets

screenElements:
Top Navigation Bar
Logo
Icon
Side Navigation
Progress Indicator
Stacked List

screenPatterns:
Home
Progress
Settings & Preferences

pageType: Application Application Application Application Application Application Application

screenKeywords:
Vanta ® & @ (N
Compute instances 2 Edit bulk tag
A MEme Seeing some accounts that should not be here? Learn more about scoping out resources.
Y= Tests STANDARD
[ Report Autoscale groups (0) Q All owners v ¥ Export all results
eports
Cluster deployments (0)
Eemelisnes Compute instances (0) ® Vvanta supports reading tags from various cloud provider integrations to populate different Edit bulk tag X
) e attributes. We recommend using Vanta tags or custom tags to populate attributes as they are
Computers (Vanta a... (23) continuous checked and are more scalable. Learn more.
[ Risk Container clusters (0)
& Vendor Container repositories (0)
I = Assets Data warehouses (12) No results found
There aren't any results for this query.
Inventory GCP Organization Pr... (2)
- Git repositories (4)
Vulnerabilities
Kubernetes clusters (0)
Settings
Load balancers (0)
22 Personnel
NoSQL databases (0)
Y Integrations Platform-as-a-service (9)
Queues (0)
Relational databases (5)
Serverless functions (0)
Storage buckets (19)
Stream clusters (0)
CUSTOM
p All custom items (0)
|Vanta ® ® @& (N
Q Help... ¥+K -
: Settings
Update settings related to your vulnerability management program
@ Home
= Tests Remediation SLAs  Vulnerability scanners
@ Reports Remediation SLAs
When vulnerabilities are detected within your infrastructure, ensure that they are triaged and remediated on-time. This allows you to prioritize possible threats and prevent
Compliance harm or loss to your environment. Learn how Vanta calculates remediation SLAs. Learn how Vanta calculates remediation SLAs.
@ Trust Center Note: If you previously set your SLAs for vulnerabilities, any changes made here will update your vulnerability settings across Vanta. Changes will be applied to new
vulnerabilities and not affect any historical or currently open vulnerabilities.
@ Risk
& Vendor
Critical View history
I = Assets
Inventory 30 N
- Vanta's recommendation: 3 - 15 days
Vulnerabilities
Settings
22 Personnel . i .
High View history
U Integrations
ki < 30 v
Vanta's recommendation: 3 - 30 days
Medium View history
60 v
Vanta's recommendation: 3 - 45 days
€l
|Vanta ® ® @& (N
Help 38 +K .
' Computers (Vanta agent) 2 Editbulk tag
Seeing some accounts that should not be here? Learn more about scoping out resources.
@ Home
Y= Tests STANDARD
Q Search... All owners v ¥ Export all results
[ Reports Autoscale groups (0)
Cluster deployments (0)
SElRlREES Compute instances (0) ® Vanta supports reading tags from various cloud provider integrations to populate different Edit bulk tag X
© Trust Center attributes. We recommend using Vanta tags or custom tags to populate attributes as they are
Computers (Vanta a... (23) continuous checked and are more scalable. Learn more.
[ Risk Container clusters (0)
£ Vendor Container repositories (0)
=
(O  os/IDENTIFIER ENCRYPTION USER DATA VERSIONING DESCRIPTION OWNER
I = Assets Data warehouses (12)
GCP Organization Pr... (2) i
iy (] " Z Admin access Encrypted — Vanta ... zg:ﬁ;ﬂ; Jane S...
. Git repositories (4) b
Vulnerabilities
Kubernetes clusters (0) 2 C.. Admin access Personr
Settings 0O & " Encrypted — Vanta ... comput:
Load balancers (0)
22 Personnel
NoSQL databases (0) 2 J.. Admin access Personr
0O & b Encrypted — Vanta ... comput:
Y Integrations Platform-as-a-service (9)
Queues (0) f Not
0 " B.. Admin access o _ Vanta ... Personr
. C.. encrypted comput
Relational databases (5)
Serverless functions (0) 0 ., L... Admin access Not . Vanta Personr
Storage buckets (19) P... encrypted comput
Stream clusters (0) . E. Admi P
. min access o ersonr
0O & v Encrypted — 9 Vanta ... comput:
CUSTOM
i . i Not
p All custom items (0) m) " all Admin access e:crypted _ Vanta .. soe:;lr};
|Vanta ® ® @& (N
Help B +K . . —
' Findings by asset < Refresh &
Monitor 3rd party vulnerabilities and ensure compliance with SLAs. Learn more.
@ Home
Y= Tests Findings by asset
o N Asset scan coverage by source Asset SLA status
@ Reports Findings by vulnerability
Deactivated
Compliance i ]
- P History O GitHub 4 @ Overdue 0
@ Trust Center aws  Amazon Web Services (AWS) 0 © Due soon 3
[ Risk £ Google Cloud Platform (GCP) 0 @ Due later 0
& Vendor @ oK 1
I = Assets
Inventory Q Search Source v Severity v Asset type v Vulnerability status v SLA status v
ViliewEities Account/Organization v
Settings
IDENTIFIER SOURCES ASSET TYPE VULNERABILITY STATUS
22 Personnel
mobbin.com (3
¥ ) = O Code repository @ No actionable vulnerabilities
¢ Integrations mobbin
@ O Code repository @ No actionable vulnerabilities
mobbin
[ . )
Code repositor ® 1High +1 more
mobbin O P y '9
2
. G O Code repository @ No actionable vulnerabilities
mobbin
1-4 of 4 results Show 20 v results per page
€l
|Vanta ® ® @& (N
<Ll s Home @ View tasks
I @ Home .
Compliance progress Last updated less than a minute ago
Y= Tests
[ Reports SOC 2 >
i )
Compliance 99/0
@ Trust Center D
103 controls complete 104 total
[J Risk P
& Vendor
= Assets Monitoring
22 Personnel .
= Policies > L Tests >
¥ Integrations Needs attention ® Needs attention ®
. D
15 OK 15 total 141 OK 148 total
© Vendors > [0 Documents >
Needs attention ® Needs attention ®
. D
46 OK 46 total 37 OK 39 total
€|
|Vanta ® ® @& (N
Settings
Update settings related to your vulnerability management program
@ Home
= Tests Remediation SLAs  Vulnerability scanners
@ Reports Vulnerability scanners
Connect the vulnerability scanners that you'd like Vanta to pull data from. Missing an integration? Browse our collections of integrations to see what's coming soon or let us
Compliance know.
@ Trust Center
[ Risk \13\ 13 Penetration Testing & Scanning View details
& Vendor
I = Assets
Aikido S it View detail
22 Personnel " ikido Security iew details
¥ Integrations
aw . . .
§, Amazon Web Services (AWS) View details
/s Azure View details
(@ Cacilian Pentest and Scanner View details
€l . Coana View details
|Vanta ® ® @& (N
Q Help... #8+K Home © View tasks
I @ Home .
Compliance progress Last updated 2 minutes ago
Y= Tests
[ Reports SOC 2 >
Compliance 99%
@ Trust Center . ]
103 controls complete 104 total
[0 Risk P
& Vendor
= Assets Monitoring
Inventory
= Policies > L Tests >
Vulnerabilities
. Needs attention ® Needs attention ®
Settings 0 7
22 Personnel
. .
M 15 OK 15 total 141 OK 148 total
¢ Integrations
© Vendors > [0 Documents >
Needs attention ® Needs attention ®
. . ]
46 OK 46 total 37 OK 39 total
€|


Connecting to Slack

screenKeywords:
X
V. t < Settings
an a Alerts
COMPANY
Finish Starter Guide Notifications Summary
_—— User permissions
15/22 tasks completed )
Daily
Roles
Weekly
Q Go to... #8+K Information
Security
OVERVIEW ~
Billing [4
Home ﬁ!.' Slack Disconnect
Frameworks
Tests
Language HR IT Engineering Policy Risk  Trust Report
COMPLIANCE ~
MY ACCOUNT Slack channel 2
Frameworks None
Notifications
Controls
Alerts
. Language
Policies
Documents Summary
TRUST ~
Daily
Trust Report
Weekly
Questionnaires
RISK ~
(] .
T —— @4 Microsoft Teams
[ ]
Vendors v
Vulnerabilities
Authorize Vanta to get started ®
ORGANIZATION ~ An admin on your Teams account needs to grant permissions
for Vanta to post notifications to the selected channels.
|Tests . Daily
Settings
Weekly
COMPLIANCE ~
COMPANY
Frameworks
Notifications
Controls =0
User permissions ﬁ.-' Slack
Policies
Roles
Documents “
Information 'Q'
TRUST ~ Security
Trust Report Billing (7 Authorize Vanta to get started
. i An admin on your Slack account needs to grant permissions
Questionnaires Frameworks for Vanta to receive the list of channels and post notifications
to the selected channels.
Language
RISK ¥ guag
Learn more Connect to Slack
Risk management MY ACCOUNT
Access Notifications
Vendors Language . A
@4 Microsoft Teams
Vulnerabilities
ORGANIZATION ~ 11
People v
Computers Authorize Vanta to get started
Inventory An admin on your Teams account needs to grant permissions
for Vanta to post notifications to the selected channels.
€3 Settings
Product updates
Mobbin
Admin
®
|ﬁ!_. slack &3 Mobbin v
. N
—
Vanta Notifications is requesting permission to
access the Mobbin Slack workspace

What will Vanta Notifications be able to view?

@ Content and info about channels & conversations »

88 Content and info about your workspace >

What will Vanta Notifications be able to do?

@ Perform actions in channels & conversations »


Completing report walkthrough

screenElements:
Coach Marks
Full-Screen Overlay

screenPatterns:
Guided Tour & Tutorial
Internal Tool

pageType: Application Application Application Application

screenKeywords:
Vanta < Trust Re po rt e https://app.vanta.com/mobbin/trust/9ripe @ @ View Edit Settings
Edit X
Finish Starter Guide
 EEE—— Gettmg started with your Trust Report Create your Trust Report by going into edit -
12/20 tasks completed mode.
Q Go to... B+K Edit your Trust Report - w
OVERVIEV AN Review and update your settings
Home
Tests @ ShorcyeurusERepest Show me how
COMPLIANCE ~
Frameworks Access
Controls
Q All v View request history
Policies
Documents Viewers granted access  Access requests
TRUST ~ Trust Report not shared
Trust Report m
Questionnaires
RISK ~
Risk management Stats
Access
Vendors A Number of Trust Report views @ R Individual page views @ D Document downloads @
Vulnerabilities 0 +0% since last week 0 +0% since last week 0 +0% since last week
®
ORGANIZATION ~
|Settings
Adjust settings
Set preferences for reminders, determine
access rights, manage users, and more from
your settings page.
(]
|Mobbin 7
This is a summary that details company information and how your company views security. Edit the report to add your company mission,
values, and security procedures.
¥ Contact: sample@company.com
Company information
Include a company overview, security contact
info, and a link to your privacy policy.
Theme your Trust Report to match your
company's branding by clicking on the banner.
:
|Mobbin 2
This is a summary that details company information and how your company views security. Edit the report to add your company mission,
values, and security procedures.
¥ Contact: sample@company.com
Compliance 7 Monitoring o
Add standards Infrastructure security Organizational security
(] o
(] o
Documents Edit  Add v °
D Add Document
Download Product security Internal security procedures ©


Test detail (to remediate)

screenElements:
Full-Screen Overlay
Avatar

screenKeywords:
Vanta < TeStSI A" 7 Edit SLAs
CATEGORY
All 80
Finish Starter Guide
HR 16
11/20 tasks completed I 3 OK 31 Needs attention 80
Policy 21
Q Go to... 38+K 27% (8 Overdue 1
Engineering 33
© Due soon 16
CEE—
OVERVIEW ~ Risks 7
310K 111 total @ Needs remediation (no SLA assigned) 63
Home Custom
Tests DEACTIVATED
Q Framework v Type v Owner v Status v Integration v Control v
COMPLIANCE ~ All deactivated .
Only upcoming tests
Frameworks
Controls NAME CATEGORY OWNER TYPE STATUS 4
Policies
- . Oct 7, 5:22
Documents /S\ggllzcatlon changes reviewed Engineering Unassigned Automated... ® PM
12 items to remedi...
TRUST ~
Oct 11, 4:43
WSS [iGTsietn l;AOFcAzon Google Workspace Information tech... Unassigned Automated... i PM
Questionnaires @ 2 items to remedi...
. Oct 11, 5:13
RISK ¥ '
Isn(;lcer;tory list tracks resources that con... Engineering Unassigned Automated... © PM
Risk management 1item to remediate
Storage data versioned or retained (GC... . . . © Oct11, 5:14
] - Engineering Unassigned Automated... PM
Vendors Recommended as a security best practice 2 items to remedi
Vulnerabilities
. . . Oct 11, 5:27
GitHub accounts associated with users . © ! @
PM
ORGANIZATION ~ s0c 2 Human resources Unassigned Automated A
|MFA on Google Workspace . o - .
X ® Needs attention @ Snooze monitoring @ Deactivate More v
Last refreshed about 2 hours ago
Items to remediate = © Due date based on SLA of 7 days
The following accounts are not protected with MFA
Needs attention (2)  Deactivated (0)
(] USER DATE DETECTED REMEDIATE BY
Mobbin October 11, 2023
O ® mobbin@mobbin.com October 04, 2023 Due in 2 days =
John Doe October 13, 2023
D ® johndoe@mobbin.com October 06, 2023 Due in 4 days =
1-2 of 2 results Show 10 v results per page Previous Next
How to fix Share feedback on these instructions [
Enforce multifactor authentication on all your organization's Google accounts.
0 Log in to the Google admin console.
9 Click Security | Authentication | 2-step-verification to enforce 2-step verification.
9 Select Turn on enforcement from date.
Q Enter a date by which all of your users are required to use multifactor authentication to access their Google accounts. We recommend selecting a date two to four weeks in the future, as
employees without multi-factor authentication will be unable to sign in to their accounts once enforcement is in effect. (More information from Google Workspace)
®
Remediation history ® 09/04/2023 09/10/2023
|MFA on Google Workspace . . o .
X ©® Needs attention @ Snooze monitoring @ Deactivate More v
Last refreshed 22 minutes ago
v Details
Description Notes
SOC 2
Verifies that all members of the Google Workspace organization have multi-factor
authentication enabled, unless that user has been added to the organization within the
configured SLA.
Owner
Jane Smith  Edit
Subscribers ©®
X
v Related frameworks and controls + Add control
FRAMEWORK SECTION CODE CONTROL OWNER
SOC 2 CC 61 Unique production database authentication enforced Unassigned =
sSOC 2 CC6.1-CC6.6 Remote access MFA enforced Unassigned =®
®
|MFA on Google Workspace . . o .
X ® Needs attention @ Snooze monitoring w Deactivate More v
Last refreshed 13 minutes ago @ Refresh
Remediation history ® 09/04/2023 09/10/2023
o No items were remediated in the selected period.
Items Select a different date range.
v Details
Description Notes
SOC 2
Verifies that all members of the Google Workspace organization have multi-factor
authentication enabled, unless that user has been added to the organization within the
configured SLA.
Owner
A Unassigned Edit
Subscribers ©®
% ®


Adding a note

screenElements:
Toast
Editable Text

screenKeywords:
X Code of Conduct SOC 2 More v
Draft Submit for approval
Policy editor
English
Last edited by Jane Smith « Oct 9 2023 m
+ Add another language
v Details
Description Notes
Develops and maintains a standard of conduct that is acceptable to the company and its Company internal code of conduct
employees, customers, and vendors.
Time sensitivity & recurrence
2 Renew annually
v Related frameworks and controls
FRAMEWORK SECTION CODE [l OWNER
Note saved successfully ®
SOC 2 cCc11a Code of Conduct acknowledaged by contractors Unassigned
|X Code of Conduct SOC 2 More v
Draft Submit for approval
Policy editor
Engllsh. .
Last edited by Jane Smith « Oct 9 2023
+ Add another language
v Details
Description Notes
Develops and maintains a standard of conduct that is acceptable to the company and its IAdd additional context about this specific policy.
employees, customers, and vendors.
Time sensitivity & recurrence X v
2 Renew annually
v Related frameworks and controls
FRAMEWORK SECTION CODE CONTROL OWNER
®
SOC 2 cCc11a Code of Conduct acknowledaged by contractors Unassianed
|X Code of Conduct SOC 2 More v
Draft Submit for approval
Policy editor
Engllsh. .
Last edited by Jane Smith « Oct 9 2023
+ Add another language
v Details
Description Notes
Develops and maintains a standard of conduct that is acceptable to the company and its Add additional context about this specific policy.
employees, customers, and vendors.
Time sensitivity & recurrence
2 Renew annually
v Related frameworks and controls
FRAMEWORK SECTION CODE CONTROL OWNER
®
SOC 2 cCc1a Code of Conduct acknowledaged by contractors Unassianed
|X Code of Conduct SOC 2 More v
Draft Submit for approval
Policy editor
Engllsh. .
Last edited by Jane Smith « Oct 9 2023
+ Add another language
v Details
Description Notes
Develops and maintains a standard of conduct that is acceptable to the company and its Company internal code of conduct
employees, customers, and vendors.
Time sensitivity & recurrence X v
2 Renew annually
v Related frameworks and controls
FRAMEWORK SECTION CODE CONTROL OWNER
®
SOC 2 cCc11a Code of Conduct acknowledaged by contractors Unassigned


Policy detail (completed)

screenKeywords:
Vanta ® ® @& (N
Policies More v
@ Home
Q Framework v Status v Type v Require my approval Sort by Recommended order v N =
Y= Tests
(1) Reports Name Frameworks Status Last approved on Personnel acceptance ®
I Compliance Code of Conduct soc 2 © 0K Apr 30, 2024 © 46/46
Frameworks
Information Security Policy (AUP) SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Controls
Policies Informatl.orls.ecurlty Roles and — © oK Apr 30, 2024 © 26/46
Responsibilities
Documents
Audits Asset Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Trust Center
Access Control Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Risk
& Vendor Data Management Policy SoC 2 © OK Apr 30, 2024 @ 46/46
= Assets
Operations Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
22 Personnel
" i Human Resource Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
¢ Integrations
Physical Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Risk Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
<l Third-Party Management Policy SOC 2 QoK May 2, 2024 @ 46/46
|Vanta ® ® @& (N
Policies
o Home Code of Conduct ¥ Download template More v
Y= Tests
@ Reports Need to make an update?
You can create a new version by editing an existing policy
I TeeE (created in Vanta), importing, or starting new.
Frameworks
Controls
Policies
Documents v Approved
Audits ™ Version (Apr 30 2024) | | Via file upload (.pdf)
@ Trust Center
. English View
@ Risk Last edited by Jane Smith v Approved by Alex Smith (You)
& Vendor
= Assets
22 Personnel
v Details
¥ Integrations
Description Notes
Develops and maintains a standard of conduct that is acceptable to the
company and its employees, customers, and vendors.
Frameworks
€l
SOC 2
|Vanta ® ® @& (N
v Details
@ Home
Y Description Notes
¥= Tests
Develops and maintains a standard of conduct that is acceptable to the
[ Reports A
company and its employees, customers, and vendors.
I Compliance
Frameworks
Frameworks
SOC 2
Controls
Policies Time sensitivity & recurrence
Documents 2 Renew annually
Audits
@ Trust Center
@ Risk v Related frameworks and controls
& Vendor
FRAMEWORK SECTION CODE CONTROL OWNER
= Assets
22 personnel SOC 2 CC11 Code of Conduct acknowledged by contractors Alex Smith (You)
ﬁ Integrations S0OC 2 CC11-CC15 Code of Conduct acknowledged by employees and enforced Unassigned
SOC 2 CC22-CC51-CC5.2-CC5K.3 Security policies established and reviewed Unassigned
> Related audits
€|


Settings

hotspotType: Scroll Vertically

screenPatterns:
Settings & Preferences
Settings & Preferences
Settings & Preferences

screenKeywords:
9:41 wll T @m)
[am———
VIBES X
AA  RHYTHM
! ACHIEVEMENTS
22 HAPTICS .
7O> KEEP SCREEN ON .
M ouick cuIpe
SUPER ! BORING
. MEMBERSHIP SUPER
. APP ICON GRAPHITE
= ADD A WIDGET
* WALLPAPERS
APPS
7 & ~
e e SV
|9:41 all ¥ @)
[ )
&) SsuPPORT
% GET NEWSLETTER
W TERMS & PRIVACY
wY FoLLOW ON TWITTER
1 VISIT WEBSITE
7] MUSIC BY THOMAS WILLIAMS

-0°0-

THE !'BORING SOFTWARE CORPORATION MAKES FUN
SOFTWARE FOR LIFE'S BORING MOMENTS.
»— SEATTLE, USA —

1.4 (2)

. ]
|9:41 all F (@m)
[a————
. MEMBERSHIP SUPER
. APP ICON GRAPHITE
c
mm ADD A WIDGET
* WALLPAPERS

APPS
HABITS  WEATHER VIBES
CALCULATOR  TIMER

v RATE APP
&) SuPPORT
% GET NEWSLETTER

. ]
|9:41 all ¥ (|
\J’v‘v’vvaO


Filtering customer stories

pageType: Marketing

pageType: Marketing Marketing

screenKeywords:
vanta Product v  Solutions v  Customers Plans Resources v  Company Vv Login
Browse all success stories
Clear all filters
| (G B compiycube
Flossie saves time How The MJ Taptap Send takes How ComplyCube
while building trust Companies the work out of completes security
with Vanta establishes managing risk with questionnaires 7x
customer trust with Vanta faster with Vanta
Vanta
Find out more > Find out more > Find out more > Find out more >
AA \QRERN % FACTORY USHE I\l Align Al
Modern Health <aves Factorv adheres<s to How IS Med-Fauin Coxwave achieves
|vanta Product v  Solutions v  Customers Plans Resources v  Company Vv Login
Browse all success stories
Asia X Clear all filters
I\l Align Al BLADELABS dacime tailor
Coxwave achieves Blade Labs builds Acme Technology How Tailor built trust
compliance for its trust through accelerates growth and gained
Align Al solution with seamless with Vanta credibility with SOC 2
Vanta certification with compliance
Vanta
Find out more = Find out more = Find out more = Find out more =
[XRRakkaR @


Guide detail

screenPatterns:
Guided Tour & Tutorial
Progress

screenKeywords:
Vanta <« Starter Guide How Vanta Works X
Finish Starter Guide Welcome to Vanta! Automate your compliance program
W ét%%eklerate your account setup and audit prep. Pick up where you left off and check out our in-app hel To stay compliant, you'll need to prove to auditors that

controls, processes, and configurations are in place. Vanta
will automatically collect the necessary evidence when it's

Q Go to... #+K . . . . . .

V Intro to Vanta ¢ time for your audit using third-party integrations.

OVERVIEW ~ Learn about your frameworks and how Vanta works to meet your security and

compliance needs.
Home ’ -
Tests @ How Vanta works —
@ & =™
- S
COMPLIANCE ~ Framework progress . 7
Frameworks <
Intro to SOC 2

Controls O s

elfiefias Invite collaborators

Documents %

i R
)
.
e Connect your key systems 0 '
Trust Report v
Connecting integrations enables Vanta to automate evidence collection and {I)

Questionnaires @ monitoring for you.

RISK ¥ Connect identity provider

Risk management Why integrations matter

Connect cloud provider
Access Integrations are at the heart of Vanta's product, and a
Vendors Connect version control system critical piece of automating your compllanc_e program.
Integrations automatically create tests, which are mapped

Vulnerabilities Connect HR system to controls within frameworks.

. , ®

AT < For example, one requirement for SOC 2 is that all

employees go through an extra authentication layer when
|. s o 1 .
Finish Starter Guide Welcome to Vanta! Starter Guide Progress
E— Accelerate your account setup and audit prep. Pick up where you left off and check out our in-app help resources if you get
0/20 tasks completed stuck.

Oof4
key systems connected
Q Go to... #8+K
\V} Intro to Vanta 0 of Tcomplete A 0of 3
OVERVIEW ~ Learn about your frameworks and how Vanta works to meet your security and starter policies approved
compliance needs. .

Home Auditor selected

Tests How Vanta works View details

COMPLIANCE ~ Framework progress

Frameworks

Intro to SOC 2

Controls

Policies Invite collaborators

Documents

TRUST ~

.. Connect your key systems 0 of 4 complete A
Trust Report v
Connecting integrations enables Vanta to automate evidence collection and

Questionnaires @ monitoring for you.

RISK ¥ Connect identity provider

Risk management

Connect cloud provider
Vendors Connect version control system
Vulnerabilities Connect HR system
®
ORGANIZATION ~
|. s o 1 .
Finish Starter Guide Welcome to Vanta! Starter Guide Progress
E— Accelerate your account setup and audit prep. Pick up where you left off and check out our in-app help resources if you get
0/20 tasks completed stuck.

Oof4
key systems connected
Q Go to... #8+K
\V} Intro to Vanta 0 of Tcomplete A 0of 3
OVERVIEW ~ Learn about your frameworks and how Vanta works to meet your security and starter policies approved
compliance needs. .

Home Auditor selected

Tests How Vanta works

COMPLIANCE ~ Framework progress

Frameworks

Intro to SOC 2

Controls

Policies Invite collaborators

Documents

TRUST ~

.. Connect your key systems 0 of 4 complete A
Trust Report v
Connecting integrations enables Vanta to automate evidence collection and

Questionnaires @ monitoring for you.

RISK ¥ Connect identity provider

Risk management

Connect cloud provider
Vendors Connect version control system
Vulnerabilities Connect HR system
®
ORGANIZATION ~


Sorting policies

screenPatterns: Misc Loading

screenKeywords:
Vanta ® ® @& (N
Policies More v
@ Home
Q Framework v Status v Type v Require my approval Sort by Recommended order v N =
Y= Tests
(1) Reports Name Frameworks Status Last approved on Personnel acceptance ®
I Compliance Code of Conduct soc 2 © 0K Apr 30, 2024 © 46/46
Frameworks
Information Security Policy (AUP) SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Controls
Policies Informatl.orls.ecurlty Roles and — © oK Apr 30, 2024 © 26/46
Responsibilities
Documents
Audits Asset Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Trust Center
Access Control Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Risk
& Vendor Data Management Policy SoC 2 © OK Apr 30, 2024 @ 46/46
= Assets
Operations Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
22 Personnel
" i Human Resource Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
¢ Integrations
Physical Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Risk Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
<l Third-Party Management Policy SOC 2 QoK May 2, 2024 @ 46/46
|Vanta ® ® @& (N
Policies More v
@ Home
Q Framework v Status v Type v Require my approval Sort by Last approved on v N =
Y= Tests
(1) Reports Name Frameworks Status Last approved on Personnel acceptance ®
I Compliance
Frameworks
Controls
Policies
Documents
Audits
@ Trust Center
[ Risk
& Vendor
= Assets
22 Personnel
¥ Integrations
Show per page v
€l
|Vanta ® ® @& (N
Policies More v
@ Home
Q Framework v Status v Type v Require my approval Sort by Last approved on v N =
Y= Tests
(1) Reports Name Frameworks Status Last approved on Personnel acceptance ®
I Compliance Code of Conduct soc 2 © 0K Apr 30, 2024 © 46/46
Frameworks
Information Security Policy (AUP) SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Controls
Policies .
Asset Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Documents
Information Security Roles and
AT Responsibilities SoC 2 © oK Apr 30, 2024 @ 46/46
@ Trust Center
Access Control Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Risk
& Vendor Data Management Policy SoC 2 © OK Apr 30, 2024 @ 46/46
= Assets
Human Resource Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
22 Personnel
" i Operations Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
¢ Integrations
Physical Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Risk Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
<l Third-Party Management Policy SOC 2 QoK May 2, 2024 @ 46/46
|Vanta ® ® @& (N
Policies More v
@ Home
Q Framework v Status v Type v Require my approval Sort by Recommended order v N =
Y= Tests
v Recommended order
(1) Reports Name Frameworks Status Last approved on
Name
I Compliance Code of Conduct SoC 2 © oK Apr 30, 2024 Status
e Last approved on
Information Security Policy (AUP) SOC 2 Q@ OK Apr 30, 2024 ©@ 46/46
Controls
Policies Informatl.orls.ecurlty Roles and = ® oK Apr 30, 2024 © 46/46
Responsibilities
Documents
Audits Asset Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Trust Center
Access Control Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
@ Risk
& Vendor Data Management Policy SoC 2 Q OK Apr 30, 2024 @ 46/46
= Assets
Operations Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
22 Personnel
" i Human Resource Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
¢ Integrations
Physical Security Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
Risk Management Policy SOC 2 Q@ OK Apr 30, 2024 @ 46/46
<l Third-Party Management Policy SOC 2 Q OK May 2, 2024 @ 46/46


Quick guide

screenPatterns:
Settings & Preferences
Other Content

screenKeywords:
9:41 wll T @m)
[am———
VIBES X
AA  RHYTHM
! ACHIEVEMENTS
22 HAPTICS .
7O> KEEP SCREEN ON .
M ouick cuIpe
SUPER ! BORING
. MEMBERSHIP SUPER
. APP ICON GRAPHITE
= ADD A WIDGET
* WALLPAPERS
APPS
7 & ~
e e SV
|9:41 all T @
< QUICK GUIDE X

Vibes Support

LU Quick Guide

Play/Pause

Tap the minimap in the bottom right to

pause your vibe. Tap the play button to

resume.

Change vibe

Tap the minimap in the bottom right and

select a vibe.

Swipe up/down to adjust energy

Eneray affects the intensity of vour vibe.
|9:41 il S @m
< QUICK GUIDE X
LV


Landing page

pagePatterns:
Landing Page
Hero Section

screenElements:
Top Navigation Bar
Button
Banner
Logo

pagePatterns:
Landing Page
CTA Section

pagePatterns:
Landing Page
Stats Section

screenElements: Card Thumbnail

pagePatterns:
Landing Page
Footer Section

screenElements:
Card
Thumbnail
Navigation Menu
Top Navigation Bar
Button
Banner
Logo
Card
Thumbnail

pagePatterns:
Landing Page
Landing Page
Social Proof (Logo Cloud) Section
Landing Page
Social Proof (Testimonial) Section
Landing Page
Landing Page
CTA Section
Landing Page
Stats Section
Content Section
Landing Page
Hero Section
Landing Page
CTA Section
Landing Page
Footer Section
Landing Page

pageType: Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing Marketing

screenKeywords:
vanta Product v  Solutions v  Customers Plans Resources v  Company v Login
The all-in-one trust management platiorm
Automated compliance Continuous GRC Vendor Risk Management Questionnaire
Automate evidence collection Move beyond point-in-time Safely introduce cutting-edge Automation
for 30 compliance frameworks assessments with continuous software to your business by Complete security reviews up to
like SOC 2, 1SO 27001, GDPR, and controls monitoring and risk identifying and monitoring five times faster with Al-
more. management. vendor risk and protecting powered security
customer data. questionnaires and trust
centers.
Explore compliance - Explore GRC - Explore VRM - Explore questionnaires —>
L | -
[ | - O
—_ 1131 o
| | -
|vanta Product v  Solutions v  Customers Plans Resources v  Company v Login
Trusted by thousands of customers, from startup to enterprise
A\ ATLASSIAN H xifTRAL ICELANDAIRA m miro Qzl}i[:wl}[l 'A HME(RBERN
The all-in-one trust management platiorm
Automated compliance Continuous GRC Vendor Risk Management Questionnaire
Automate evidence collection Move beyond point-in-time Safely introduce cutting-edge Automation
for 30 compliance frameworks assessments with continuous software to your business by Complete security reviews up to
like SOC 2, ISO 27001, GDPR, and controls monitoring and risk identifying and monitoring five times faster with Al-
more. management. vendor risk and protecting powered security
customer data. questionnaires and trust
centers. @
Explore compliance = Explore GRC > Explore VRM > Explore guestionnaires =
|vanta Product v  Solutions ~  Customers Plans Resources v  Company Vv Login
Vanta
Startup Service provider directory Partner program overview :;:;Iutionizing i
Grow faster with automated Discover world-class service Set yourself apart with Vanta. ial/?t\?\ {e‘rr‘r;gnagc s
compliance. providers.
Service providers
Mid-market Auditor directory Build, scale, and grow your
Expand security and compliance Connect with top compliance business. . . .
" Y P . peomp Revolutionize risk:How to
as you scale. auditors.
) manage risk with Vanta
Auditors
Enterprise Integrations Elevate your clients' experiences. Download the eBook ->
Build more trust in your Sync with 300+ tools.
established brand.
Ll UOL bUllLlllUUUDly i I B 0 § B I I B B B N
W Critcal @ High W Medium W Low B Assigned Unassigned
Vanta's trust management platform takes the manual work rameworkprogress Speoming s
out of your security and compliance process and replaces =
e 150270012022 Audit ,
it with continuous automation—whether you're pursuing K e:
pet _‘__-;:' - 2 TSl EOC2Type\Audl( N
your first framework or managing a complex program. '::?':*-'-_:-'f--,..:.._,_,/ ; H"mm“
5002 ==150270012022 - GOPR - HPAA - NST800-53 @ e i
Request ademo 9 Total revenue influenced
$1.75M e
||Van‘ta Product v Solutions v Customers Plans Resources v Company v Login
Learn about Vanta and
||vanta Product v  Solutions v  Customers Plans Resources v  Company Vv Login
[J [J
Get compliant and build trust—fast s s s
Top 50 Top 50 Top 100
Security Products. Products for Mid-Market Highest Satisfaction Products.
e e e
Requestademo - v
Product Frameworks Solutions Become a partner Resources Articles Company
Automated compliance SOC 2 Startup Partner program All resources SOC 2 compliance About
overview
Continuous GRC ISO 27001 Mid-market SOC 2 collection SOC 2 checklist (e TR HIRING |
i . Service providers . N
Vendor risk management GDPR Enterprise ISO 27001 collection ISO 27001 certification Press
Auditors
Questionnaire HIPAA GRC collection 1ISO 27001 Security
automation Customers documentation
HITRUST CSF Find a partner TPRM collection System status
Trust center Customer stories What is VRM?
USDP Service provider Help center Support status
Release notes dliresiEny What is GRC?
Platform NIST Al RMF Vanta Academy Trust center
Trust management ISO 42001 (IR ClIREETy Community
[PIEEEITR Custom frameworks NS Vanta for developers
pentsntoEtens Additional frameworks
Vanta Al 4
Vanta API
=
( |
)
|vanta Product v  Solutions v  Customers Plans Resources v  Company ~ Login
. \
About Security 4 +
, . & +; TryVanta Al
Learn more about Vanta. Understand Vanta's security and compliance .
strategy. N ’aa b
Careers Press \
. , -
Join ourteam! See the latest in Vanta news and press releases. Lo e
Introducing Vanta Al: Powering the future
of trust management
Learn More >
= e T st TssrTr T T J -c:aw .H\gl\- lMedw: ILow- - - IA;ned :asslgned - - - -
Vanta's trust management platform takes the manual work ramework progress opeoming it
out of your security and compliance process and replaces =
it with continuous automation—whether you're pursuing //AT:\_\\— e >
Pt ol . e SOC 2 Type | Audit N
your first framework or managing a complex program. ESivaan : —
p— - e - - ‘ igczrype\lfud“ N
Request a demo 9 Total revenue influenced
$1.75M o
||vanta Product v  Solutions v Customers  Plans  Resources v Company v Login
Learn about Vanta and trust management
) 1 o e ——
pre e R—
Vanta HITRUST =] r—
7/ //' — e e
Jw, © =
COMPLIANCE PRODUCT UPDATES PRODUCT UPDATES
3 trends shaping the future of Announcing Vanta’s industry- Vanta Trust Center, now
GRC and how to adapt today first partnership to automate enhanced with Questionnaire
Managing GRC today still requires a ton of manual HITRUST el Automation and Vanta Al
Work'—but it‘doesn’t TR T el T 2 37 Vanta has partnered with HITRUST to be the first Introducing new innovations that help enterprises
SIRE B BRI RITE WETE GRT ERE R RN automated compliance solution of the HITRUST e1 win customer trust and close deals fast.
Assessment, helping you demonstrate your...
Get compliant and build trust—fast ¢ g ¢ @
- I"Nn - I"N - 1N
|vanta Product ~  Solutions v  Customers Plans Resources v  Company Vv Login
On-demand Elr

Automated compliance Trust management platform sSOoCc 2 product - . -
Get (and stay) compliant with ease. Deepen your security—and demo [ER— -

customer trust. 1ISO 27001 = =
Conti GRC =

ontinuous . ) GDPR ) !)L./

Join the modern way to GRC. Vanta integrations

Sync with 350+ tools.

4 HIPAA Product Demo
ReldoniSKmanagement . Check out Vanta in action
Streamline vendor security VantaAl - BUIRUSIECSE
reviews. Hand off your most tedious tasks. Watch now —>
USDP

Questionnaire automation Vanta API NIST Al RMF
Auto-fill security questionnaires. Enhance your security and

compliance automation. 1SO 42001
Trust center
Demonstrate trust in real-time. CUStemiameworks

Additional frameworks
et e e Y s e e g I e o g e S @ -
5002 -=150270012022 - GDPR - HPAA - NST800-53 @ e i
Request a demo 9 Total revenue influenced
$1.75M e
|vanta Product v  Solutions v Customers Plans Resources v Company v Login
VantaCon is coming back to San Francisco on Nov. 20! Register and save on early bird tickets today Register now -
S Program overview report
@ Program task completion rate within SLA over the last 3 months
I (@ Reports 75% 80 of 80 on time 5QY, oornzonime 85, 1ozetnoonume
A I ® o . e e
utomate compilance, :
° o Inherent risk Assigned controls
manage risk, and prove : C Ly
— ] ] ° blhbre il
trust—continuously Pa bl [ 11
@ Critical @ High W Medium W Low B Assigned Unassigned
Vanta's trust management platform takes the manual work ramework progress opeoming it
out of your security and compliance process and replaces =
it with continuous automation—whether you’re pursuing f ®: '
== e T T TS 50C 2 Type | Audit N
your first framework or managing a complex program. e ;
p— - e . - ‘ s/gczrype\lkvud“ N
Request ademo 9 Total revenue influenced
$1.75M 2
|vanta Product v Solutions v Customers  Plans  Resources v Company v Login
= I B 1§
Start-to-finish support for 30
compliance frameworks
27001 JHIPAY 42001 ,(j&DP/R;*
Simplifying security and compliance )
|Van‘ta Product v  Solutions v  Customers Plans Resources v  Company Vv Login Request a demo
Product Frameworks Solutions Become a partner Resources Articles Company
Automated compliance SOC 2 Startup Partner program All resources SOC 2 compliance About
. . overview . i
Continuous GRC ISO 27001 Mid-market SOC 2 collection SOC 2 checklist (e TR HIRING |
i . Service providers . N
Vendor risk management GDPR Enterprise ISO 27001 collection ISO 27001 certification Press
. . Auditors . .
Questionnaire HIPAA GRC collection 1ISO 27001 Security
automation Customers . documentation
HITRUST CSF Find a partner TPRM collection System status
Trust center Customer stories What is VRM?
USDP Service provider Help center Support status
Release notes dliresiEny What is GRC?
Platform NIST Al RMF Vanta Academy Trust center
Trust management ISO 42001 (IR ClIREETy Community
[PIEEEITR Custom frameworks NS Vanta for developers
pentsntoEtens Additional frameworks
Vanta Al '+
Vanta API
Terms Privacy Do Not Sell or Share My Personal Information TYPE Il 27001 GDPR
Modern Slavery Act Statement
Vanta Vanta Vanta
© 2024 Vanta. All rights reserved
=)
\L‘"mh
S
o/
|


Tests (old)

screenElements:
Side Navigation
Badge

screenElements:
Coach Marks
Side Navigation
Badge

screenPatterns:
Guided Tour & Tutorial
Dashboard

screenKeywords:
Vanta < TeStSI A" 7 Edit SLAs
CATEGORY
All 80
Finish Starter Guide
HR 16
11/20 tasks completed I 3 OK 31 Needs attention 80
Policy 21
Q Go to... 38+K 27% (8 Overdue 1
Engineering 33
© Due soon 16
CEE—
OVERVIEW ~ Risks 7
310K 111 total @ Needs remediation (no SLA assigned) 63
Home Custom
Tests DEACTIVATED
Q Framework v Type v Owner v Status v Integration v Control v
COMPLIANCE ~ All deactivated .
Only upcoming tests
Frameworks
Controls NAME CATEGORY OWNER TYPE STATUS 4
Policies
- . Oct 7, 5:22
Documents /S\ggllzcatlon changes reviewed Engineering Unassigned Automated... ® PM
12 items to remedi...
TRUST ~
Oct 11, 4:43
WSS [iGTsietn l;AOFcAzon Google Workspace Information tech... Unassigned Automated... i PM
Questionnaires @ 2 items to remedi...
. Oct 11, 5:13
RISK ¥ '
Isn(;lcer;tory list tracks resources that con... Engineering Unassigned Automated... © PM
Risk management 1item to remediate
Storage data versioned or retained (GC... . . . © Oct11, 5:14
] - Engineering Unassigned Automated... PM
Vendors Recommended as a security best practice 2 items to remedi
Vulnerabilities
. . . Oct 11, 5:27
GitHub accounts associated with users . © ! @
PM
ORGANIZATION ~ s0c 2 Human resources Unassigned Automated A
|Staying on track X
This is the list of tests that are failing and need
remediation from test owners.
Needs attention 80
Tests need remediation with differing levels of
urgency: Overdue 1
¢ Overdue: past the due date that you've
committed to in the SLA. Due soon 16
* Due soon: have an approaching due date. Needs remediation (no SLA assigned) 63
+ Needs remediation: don't have a specific
due date, but are failing.
[ J
|vanta < Home © View tasks
Finish Starter Guide Framework v
13/20 tasks completed
Compliance progress
Q Go to... ®+K
OVERVIEW ~ S0OC 2 >
Home o
24%
Tests
CEEEEE——
COMPLIANCE ~ 19 controls complete 80 total
Frameworks
Controls
bolicios Monitoring
Documents
= Policies > L Tests >
TRUST ~
Trust Report Needs attention @ Needs attention @
Questionnaires @ 14 37
- . ]
RISK ~ 10K 15 total 310K 68 total
Risk management
Access
Vendors
- © Vulnerabilities > = Vendors >
Vulnerabilities
Needs attention @ Needs attention @ ®
ORGANIZATION ~ 4 5
|.
eatn A
. ——— -
——— .
.
Welcome to the Tests page! X
Welcome to your dashboard for managing
automated tests in Vanta.
Here, you can:
¢ assign test owners,
¢ remediate failing tests, and
¢ deactivate tests that don't apply to your
organization.
. m
.
.
.
.


Event log

screenElements:
Dropdown Menu
Avatar

screenElements:
Dropdown Menu
Avatar
Top Navigation Bar
Logo
Icon
Side Navigation
Progress Indicator

screenPatterns:
Timeline & History
Home
Progress

screenKeywords:
Vanta ® ® @& (N
Q Help... #+K . . N
Monitoring
I @ Home Jane Smith
. o @mobbin.com
>

Y= Tests 1= Policies 4 Tests View-only Admin - Mobbin
[ Reports Needs attention ® Needs attention ® My notification settings
A . 0 7 #% Refer a friend to Vanta
e ] o ———————————————.~ | Earn $500 for each new sign up
@ Trust Center 15 OK 15 total 141 OK
@ Risk Event log

Overview

S Vendors > Y Documents Sign out

Risk register

Risk library Needs attention ® Needs attention ® Vanta status - Privacy policy

Action tracker

.______________________________________________________________________________J . ]

Snapshots 46 OK 46 total 370K 39 total

Settings
& Vendor
= Trust Center
= Assets
22 Personnel Total visits Individual page views " Resource downloads

@ 8 +0% since last week @ 21 +0% since last week - 0 +0% since last week
U Integrations
View Trust Center page -
€l
|Vanta ® ® @& (N
Help.. B+K
: Event log
@ Home Monitor and track a history of changes made by users within Vanta. It is useful for tracking down administrative activities, data modification, and user logins.
Y= Tests _
Type v Source v Action v Target v 9 Select date range ¥ Export CSV
[ Reports
- i TYPE DATE SOURCE ® ACTION TARGETS DETAILS ®
Compliance
@ Trust Center Sep 11, 2024 Jane Smith I - I -
User 11:08 AM View-only Ad... Login Authentication method Jane Smith logged in via Google.
@ Risk
- User s_ep 4, 2024 Ale)fla Smith Send personnel remi... User Alexia Smith sent a reminder to complete security tasks ...
& Vendor 5:06 PM Admin
=
= Assets User
22 Personnel
User
¥ Integrations
User
User
User
User
User
User
€| User
|Vanta ® ® @& (N
<Ll s Home @ View tasks
I @ Home .
Compliance progress Last updated less than a minute ago
Y= Tests
[ Reports SOC 2 >
i )
Compliance 99/0
@ Trust Center D
103 controls complete 104 total
[J Risk P
& Vendor
= Assets Monitoring
22 Personnel .
= Policies > L Tests >
¥ Integrations Needs attention ® Needs attention ®
. D
15 OK 15 total 141 OK 148 total
© Vendors > [0 Documents >
Needs attention ® Needs attention ®
. D
46 OK 46 total 37 OK 39 total
€|


Automated compliance

pagePatterns:
Features Page
Hero Section

screenElements: Illustration Icon

screenElements:
Illustration
Icon
Navigation Menu

pagePatterns:
Social Proof (Logo Cloud) Section
Features Page
Hero Section
Feature Section

pageType: Marketing Marketing Marketing Marketing Marketing

screenKeywords:
Van‘ta Product v  Solutions v  Customers Plans Resources v  Company Vv Login
The trust management platform trusted by more than 8,000 customers
AN e ] M
NYULangone % A ATLASSIAN E-__-== x§STRAL ceranoaim m =
R
SOC2
Controls Mapped Frameworks \/
1SO
Everv fram rk n d SOC2 1S027001  HIPAA 27001
very framework you nee \s2/
Vanta supports 30 leading security and privacy 1S0 27001  HIPAA  GDPR °§ Y
frameworks, like SOC 2, 1ISO 27001, HIPAA, and more (or @
customize your own)—and automates up to 90% of the I
i . HIPAA  GDPR (=0
work associated with them. +'GDPR.*
SOc2 IS0 27001
3 iz
\USDE/
|vanta Product v  Solutions v  Customers Plans Resources v  Company v Login
° .
compliance, pain iree
Request a demo to get started
Put your audit prep on autopilot—and finish in 50%
less time than doing it the traditional way. Vanta Work email*
automatically gathers the evidence you'll need to
. . . Company headcount*
get compliant—and continuously monitors your
systems to make sure you stay compliant. Please select “
Where is your company headquartered?*
Pt | O o mmmremommmooooeoeooo Please select N
aws IA ° frems overdue How did you hear about us?
- e ———— - >
; Risk Management
' > Please select o
i 8 Risk Distribution Progress © Items due soon
B (e u S (O rminterested in becoming a Vanta partner as an MSP,
N i = .ll s 1 P Reseller, or Partner.
i . HE . ’ Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the
| N u u b 2 /_/ email provided for scheduling and marketing purposes.
1 I
& R e Aok scoe 15027001
. 68% Request a demo
N 1
- soc 2
68% @
|Van‘ta Product v  Solutions v  Customers Plans Resources v  Company Vv Login
_J/ ¢
B v

People management Pre-built and custom controls Audit experience

Keep staff compliant automatically with out-of-the- Use our pre-built controls or bring your own—and Plan, prep for, and execute your audits, all within

box security awareness training videos, in-app track their status, plus the progress of mapped Vanta. Plus, use our two-way auditor

background checks, and clear onboarding and frameworks and related risks. communication tool to stay ultra-efficient through

offboarding workflows. the audit process.
=)

| 'N m| )

8
e
|vanta Product v  Solutions v Customers  Plans  Resources v Company v Login

“We see a huge time and cost difference when we

compare Vanta with the traditional audit process.

Without Vanta, we’d be looking at hiring another

person just to handle all the work that an audit and

its preparation creates.”

Willem Riehl, Director of Information Security and Acting CISO

CoachHub
&4
8
|vanta Product ~  Solutions v  Customers Plans Resources v  Company Vv Login
On-demand Elr

Automated compliance Trust management platform sSOoCc 2 product - . -
Get (and stay) compliant with ease. Deepen your security—and demo [ER— -

customer trust. 1ISO 27001 = =
Conti GRC =

ontinuous . ) GDPR ) !)L./

Join the modern way to GRC. Vanta integrations

Sync with 350+ tools.

4 HIPAA Product Demo
ReldoniSKmanagement . Check out Vanta in action
Streamline vendor security VantaAl - BUIRUSIECSE
reviews. Hand off your most tedious tasks. Watch now —>
USDP

Questionnaire automation Vanta API NIST Al RMF
Auto-fill security questionnaires. Enhance your security and

compliance automation. 1SO 42001
Trust center
Demonstrate trust in real-time. CUStemiameworks

Additional frameworks
et e e Y s e e g I e o g e S @ -
5002 -=150270012022 - GDPR - HPAA - NST800-53 @ e i
Request a demo 9 Total revenue influenced
$1.75M e


Trust Report (old)

screenElements: Accordion Toolbar

screenElements:
Coach Marks
Accordion
Toolbar
Side Navigation
Badge

screenPatterns:
Guided Tour & Tutorial
Misc
Dashboard

pageType: Application Application Application Application Application Application Application Application

screenKeywords:
Vanta < Trust Re po rt e https://app.vanta.com/mobbin/trust/9ripe @ @ View Edit Settings
Edit X
Finish Starter Guide
 EEE—— Gettmg started with your Trust Report Create your Trust Report by going into edit -
12/20 tasks completed mode.
Q Go to... B+K Edit your Trust Report - w
OVERVIEV AN Review and update your settings
Home
Tests @ ShorcyeurusERepest Show me how
COMPLIANCE ~
Frameworks Access
Controls
Q All v View request history
Policies
Documents Viewers granted access  Access requests
TRUST ~ Trust Report not shared
Trust Report m
Questionnaires
RISK ~
Risk management Stats
Access
Vendors A Number of Trust Report views @ R Individual page views @ D Document downloads @
Vulnerabilities 0 +0% since last week 0 +0% since last week 0 +0% since last week
®
ORGANIZATION ~
|Stats
Vanta <«
Finish Starter Guide A Number of Trust Report views @ R Individual page views @ D Document downloads @
— 0 +0% since last week 0 +0% since last week 0 +0% since last week
13/20 tasks completed
Q Go to... $+K
OVERVIEW ~ Controls 19% of controls shown in report
Home
Tests
v Total controls >
COMPLIANCE ~
12 of 63
FRMSIEITIE Controls shown in report @
Controls
r ]
Policies
Documents
TRUST ~ 2 Infrastructure security > il Organizational security > # Product security >
Trust Report
8 of 17 20f8 20f5
Questionnaires @ Controls shown in report @ Controls shown in report @ Controls shown in report @
RISK + CE— aEE—— aEEE——
Risk management
Access
Veng @ Internal security procedures > [a Data and privacy >
endors
Vulnerabilities 0 of 24 0 of 9
Controls shown in report @ Controls shown in report @ ®
ORGANIZATION ~
|vanta <« Trust Report
Finish Starter Guide e
12/20 tasks completed Kvanta

M e g s An efficient way to prove your security to
Q Go to... $+K D.m ‘ Mg B ot o e o e CUStomers and prOSpeCtS
OVERVIEW ~ R Vanta Trust Reports is a proactive and interactive way to
Home L o oD B S showcase your security and instill confidence in your security

= = practices.
Tests B PenTest E“':_:":'ET‘T: 5 et s syse ncnsiegspsen © Prooucion eptsmaresoces s
Learn more
COMPLIANCE ~
Controls e
Policies
S R
Documents pEmmm————
TRUST ~
Trust Report Streamline your security reviews Showcase your security
Questionnaires @ « Decrease time spent on security —_— « Display continuous control
questionnaires monitoring, documents, and your
RISK ~ « Accelerate sales by proactively ¢ security posture in one place
Risk management providing proof of security « Integrate with your website or share
out via a secure link
Access
Vendors
Vulnerabilities
®

ORGANIZATION ~
|Vanta < Trust Report ;) https://app.vanta.com/mobbin/trust/9ripe @ @ View 2 Edit Settings m
Finish Starter Guide
Getting started with your Trust Report v
12/20 tasks completed
Q Go to... $+K Edit your Trust Report w
OVERVIEW RS Review and update your settings
Home
Tests Q@ ShareyourTFrustReport Show me how
COMPLIANCE ~
Frameworks Access
Controls
Q All v View request history
Policies
Documents Viewers granted access  Access requests
TRUST ~ Trust Report not shared
Trust Report m
Questionnaires @
RISK ¥
Risk management Stats
Access
Vendors A Number of Trust Report views @ R Individual page views @ D Document downloads @
Vulnerabilities 0 +0% since last week 0 +0% since last week 0 +0% since last week
®
ORGANIZATION ~
|o J tVU% sincelast week o ) HTU/% SINce last Week S— W tV7 since fast week
Tests
COMPLIANCE ~
Frameworks
Controls 26% of controls shown in report
Controls
Policies
Documents v Total controls >
TRUST - 17 of 66
Trust Report Controls shown in report @
Questionnaires @ . ]
RISK ¥
Risk management . . . . .
& 2 Infrastructure security > il Organizational security > # Product security >
Access
Vendors 11 Of 19 4 Of 9 2 Of 5
. Controls shown in report @ Controls shown in report @ Controls shown in report @
Vulnerabilities
O O G
ORGANIZATION ~
People
Computers @ Internal security procedures > [a Data and privacy >
Inventory
0 of 24 Oof 9
i Controls shown in report @ Controls shown in report @

Integrations

Settings

Product updates

Mobbin

View-only Admin

®
|Vanta < Trust Report ;) https://app.vanta.com/mobbin/trust/9ripe @ @ View 2 Edit Settings m
Finish Starter Guide
Getting started with your Trust Report v
13/20 tasks completed
Q Go to... 38+K Q© EdityourFrustRepert Show me how
OVERVIEV g Review and update your settings w
Home
Tests Q@ ShareyourTFrustReport Show me how
COMPLIANCE ~
Frameworks Access
Controls
Q All v View request history
Policies
Documents Viewers granted access  Access requests
TRUST ~ Trust Report not shared
Trust Report m
Questionnaires @
RISK ¥
Risk management Stats
Access
Vendors A Number of Trust Report views @ R Individual page views @ D Document downloads @
Vulnerabilities 0 +0% since last week 0 +0% since last week 0 +0% since last week
®

ORGANIZATION ~
|vanta < Home © View tasks
Finish Starter Guide Framework v
13/20 tasks completed
Compliance progress
Q Go to... ®+K
OVERVIEW ~ S0OC 2 >
Home o
24%
Tests
CEEEEE——
COMPLIANCE ~ 19 controls complete 80 total
Frameworks
Controls
bolicios Monitoring
Documents
= Policies > L Tests >
TRUST ~
Trust Report Needs attention @ Needs attention @
Questionnaires @ 14 37
- . ]
RISK ~ 10K 15 total 310K 68 total
Risk management
Access
Vendors
- © Vulnerabilities > = Vendors >
Vulnerabilities
Needs attention @ Needs attention @ ®
ORGANIZATION ~ 4 5
|o J tVU% sincelast week o ) HTU/% SINce last Week S— W tV7 since fast week
Tests
COMPLIANCE ~
Frameworks
Controls 26% of controls shown in report
Controls
Policies If a control has at least one piece of evidence (test or document) passing
T I and none failing, then it is green and is shown in your report. If a control
Documents v Total ¢ has any evidence failing, then it is not shown in your report. Resolve failing >
controls in order to display them in your report. The more controls, the
TRUST ~ 17 of 6 stronger the report.
Trust Report Controls shown in report @
Questionnaires @ . ]
RISK ¥
Risk management . . . . .
& 2 Infrastructure security > il Organizational security > # Product security >
Access
Vendors 11 Of 19 4 Of 9 2 Of 5
. Controls shown in report @ Controls shown in report @ Controls shown in report @
Vulnerabilities
O O G
ORGANIZATION ~
People
computers @ Internal security procedures > [a Data and privacy >
Inventory
0of 24 Oof 9
i Controls shown in report @ Controls shown in report @

Integrations

Settings

Product updates

Mobbin

View-only Admin

®


Submitting policy for approval

pageType: Application Application Application Application Application Application Application Application Application

screenKeywords:
Assign approver X
The policy approver is often the person responsible for
this policy's enforcement (e.g. Secure Development
Policy should be approved by your CTO).
If you cannot find who you're looking for, they might not
have the necessary access. Please assign the user as
an admin or editor.
Assign different approver per language
LANGUAGE APPROVER
All Select an option v
O The selected approvers will receive an email about
this approval request. They will be able to see the
approve button once logged in with their Vanta
account. To make edits to this policy, cancel the
approval request.
Step 1 of 2 m
|X Code of Conduct SOC 2 More v
Policy editor
English
Last edited by Jane Smith « Oct 9 2023
+ Add another language
v Details
Description Notes
Develops and maintains a standard of conduct that is acceptable to the company and its Add additional context about this specific policy.
employees, customers, and vendors.
Time sensitivity & recurrence
2 Renew annually
v Related frameworks and controls
FRAMEWORK SECTION CODE CONTROL OWNER
®
SOC 2 cCc11a Code of Conduct acknowledaged by contractors Unassianed
|Vanta < Po"cies + Add custom policy 2 Edit SLAs Download language: English v More v
Finish Starter Guide Q Framework v Status v  Type v Require my approval Sortby  Recommendation v v
6/20 tasks completed

NAME FRAMEWORKS STATUS LAST APPROVED VERSION
Q Go to... #8+K
Code of Conduct SOC 2 ® OK Oct 9 2023 - 0 out of 0 accepted

OVERVIEW ~

Home Information Security Policy (AUP) SOC 2 Not started m

Tests Inf tion S ity Rol d

nformation Security Roles an
Responsibilities soc2 Not started m

COMPLIANCE ~

Frameworks Asset Management Policy SOC 2 Not started m

Controls

Access Control Policy SOC 2 Not started m

Policies

Documents Data Management Policy SOC 2 Not started m

TRUST ~

Operations Security Policy SOC 2 Not started m

Trust Report

Questionnaires @ Human Resource Security Policy SOC 2 Not started m

RIS Physical Security Policy SOC 2 Not started m

Risk management

Access Risk Management Policy SOcC 2 Not started m

Vendors

1-10 of 15 results Show 10 v  results per page Previous Next

Vulnerabilities

®
ORGANIZATION ~
|Employee assignment X
All employees in the following groups will be asked to accept the
policy in the upcoming employee reminders email.

You can configure the employee reminders email in

No employee groups
Once the policy is approved, you can assign it to
(] other employee groups in B
Step 2 of 2 Back
|Assign approver X

The policy approver is often the person responsible for

this policy's enforcement (e.g. Secure Development

Policy should be approved by your CTO).

If you cannot find who you're looking for, they might not

have the necessary access.

Assign different approver per language

LANGUAGE APPROVER

English Jane Smith (You) v
Step 10of 2
|X Code of Conduct SOC 2 More v
Draft Submit for approval
Policy editor
Engllsh. .
Last edited by Jane Smith « Oct 9 2023
+ Add another language
v Details
Description Notes
Develops and maintains a standard of conduct that is acceptable to the company and its Add additional context about this specific policy.
employees, customers, and vendors.
Time sensitivity & recurrence
2 Renew annually
v Related frameworks and controls
FRAMEWORK SECTION CODE CONTROL OWNER
®
SOC 2 cCc1a Code of Conduct acknowledaged by contractors Unassianed
|X Code of Conduct SOC 2 Download language:  English v Download template More v
Need to make an update?
Create new version
Version (Oct 9 2023) Renew
Policy editor
English .
; . . View
Last edited by Jane Smith « Approved by Jane Smith
v Details
Description Notes
Develops and maintains a standard of conduct that is acceptable to the company and its
employees, customers, and vendors.
Time sensitivity & recurrence
2 Renew annually
Approved policy ®
|Assign approver X

The policy approver is often the person responsible for

this policy's enforcement (e.g. Secure Development

Policy should be approved by your CTO).

If you cannot find who you're looking for, they might not

have the necessary access.

Assign different approver per language

LANGUAGE APPROVER

English Select an option v
Step 1 of 2
|Assign approver X
The policy approver is often the person responsible for
this policy's enforcement (e.g. Secure Development
Policy should be approved by your CTO).

If you cannot find who you're looking for, they might not
have the necessary access.
Assign different approver per language
Jane Smith (You)
LANGUAGE
Jon Smith
English Select an option v
Step 10of 2


Hiding framework sidebar

screenKeywords:
Vanta ® ® @& (N
Q Help... ¥+K Frameworks
SOC 2 More v
@ Home
= Tests Q Search... Control status v Owner v
[ Reports
REQUIREMENT CATEGORIES €l
I Compliance . Completion
CC 1.0 Control Environment
Frameworks CC 2.0 Communication and Controls OK Test (2 132133
Information
Controls 99% S 99 %
CC 3.0 Risk Assessment
Policies . 2
CC 4.0 Monitoring Activities Document (3 SHEE
103 controls 104 total S . 97 %,
Rocuments CC 5.0 Control Activities
Audits CC 6.0 Logical and Physical Access
Controls
@ Trust Center ) o .
CC 7.0 System Operations Audit timeline View audits
i . ange Management
@ Risk CC 8.0 Change M
3 Vendor CC 9.0 Risk Mitigation ° Observation completed
= Assets C1 A_dditigngl Criteria for . .
= Confidentiality # Congratulations!
% Personnel P 1.0 Privacy Criteria Related to Notice
and Communication of Objectives
Related to Privacy
¥ Integrations 020 pri Criteria Related
.0 Privacy Criteria Related to .
Choice amt oy CC 1.0 Control Environment ~
P 3.0 Privacy Criteria Related to
Collection
P 4.0 Privacy Criteria Related to Use, CC11-
Retention, and Disposal
P 5.0 Privacy Criteria Related to
<l Access CONTROL EVIDENCE READINESS OWNER
P AN Privarv Criteria Related tn
|Vanta ® ® @& (N
Q Help... #+K Frameworks
SOC 2 More v
@ Home
2 TS Q Search... Control status v Owner v
[ Reports
I Compliance Completion
RS S Controls OK
Test 3 132/133
Controls 99% . 99 %
Policies D Document & 37/38
I 103 controls 104 total e 97 %
Audits
@ Trust Center L. . - i
Audit timeline View audits
[0 Risk
Observation completed
& Vendor ° P
= Assets " .
= # Congratulations!
22 Personnel
¥ Integrations
CC 1.0 Control Environment ~
CC11-
<l CONTROL EVIDENCE READINESS OWNER


Adding recommended controls

pageType: Application Application Application Application Application

screenKeywords:
Vanta p Risk management Risk register More v Create snapshot
Review all of the risks that have been identified for your business. For each risk, review and describe the
ASSESSMENT risk treatment plan.
Finish Starter Guide Register (0)
— Library
12/20 tasks completed
Action tracker Getting started with your risk management View guided tours X
0 out of 5 completed

Q Go to... #+K Settings P
OVERVIEW ~
Home Inherent risk Residual risk
Tests

5 5
COMPLIANCE ~
Frameworks Low Low

- ®0 - ®0
Controls § §

£ Med £ Med
Policies - ©0 - ©0
Documents High High

1 20 1 =0
TRUST ~ 1 Likelihood 5 1 Likelihood 5
Trust Report
Questionnaires @
RISK ~ Q Owner v Categories v CIA Categories v Source v m
Risk management
Access You don't have any risks

Start with the Identify Risk section above.
Vendors
Vulnerabilities
®

ORGANIZATION ~
|Add 8 recommended controls? X
Risk scenario

Company data is breached due to human error and/or

misunderstanding of company requirements.
Recommended controls (8)

Whistleblower policy established &4

Management roles and responsibilities defined &4

Roles and responsibilities specified &4

Not now
Added
|vanta < Riskmanagement  Vanta risk library
Select the risks that apply to your business and track them on your risk register. For SOC 2, scenarios that
ASSESSMENT consider fraud are required.
Finish Starter Guide Register (0)
_——— Library
12/20 tasks completed
Action tracker o Get started by adding 8 or more scenarios that apply to you, then go to the register to score them. X
Q Go to... #+K Settings
Q Categories v Register v
OVERVIEW ~
FSE SCENARIO CATEGORY ADD TO REGISTER
Tests
Appropriate contacts are not maintained resulting in delays in breach . . .
P — response and reporting. Information security operatio... Add
Frameworks Appropriate contacts with interest groups are not maintained resulting
: . Information security operatio... Add
Serils in a lack of understanding of current threats.
Policies Assets are not identified and protected according to company Asset management Add
requirements. 9
Documents
TUED < Background verification checks are not carried out on all candidates or
are not proportional to the business requirements or the classification People operations Add
of the information to be accessed by the role resulting in increased risk pie op
Trust Report of malicious insider threats.
Questionnaires @
Company data is breached due to human error and/or . .
RISK misunderstanding of company requirements. Operations security Add
v
Risk management . . . . ; - .
9 Company data is breached during a disaster due to control failures. Business continuity and disa... Add
Vendors Company data is breached, corrupted or made unavailable due to a . .
malware attack. Operations security Add
Vulnerabilities
. . . . ®
R < Company data is unavailable when needed. Operations security Add
|Add 8 recommended controls? X
Risk scenario
Company data is breached due to human error and/or
misunderstanding of company requirements.
Recommended controls (8)
Whistleblower policy established &4
Management roles and responsibilities defined &4
Roles and responsibilities specified &4
Security policies established and reviewed &4
System changes communicated &4
Incident response policies established &4
Service description communicated &4
Security awareness training implemented &4
Not now
|vanta <« Riskmanagement  Vanta risk library
Select the risks that apply to your business and track them on your risk register. For SOC 2, scenarios that
ASSESSMENT consider fraud are required.
Finish Starter Guide Register (0)
_—— Library
12/20 tasks completed
Action tracker o Get started by adding 8 or more scenarios that apply to you, then go to the register to score them. X
Q Goto... #+K Settings
Q Categories v Register v
OVERVIEW ~
G SCENARIO CATEGORY ADD TO REGISTER
Tests
Appropriate contacts are not maintained resulting in delays in breach . . .
COMPLIANCE ~ response and reporting. Information security operatio... Add
Frameworks . . L .
Appropriate contacts with interest groups are not maintained resulting Information security operatio Add
Controls in a lack of understanding of current threats.
Policies Assets are not identified and protected according to company Asset management Add
requirements. 9
Documents
TE < Background verification checks are not carried out on all candidates or
are not proportional to the business requirements or the classification People operations Add
of the information to be accessed by the role resulting in increased risk pie op
Trust Report of malicious insider threats.
Questionnaires @
Company data is breached due to human error and/or . .
RISK misunderstanding of company requirements. Operations security © Added | Remove
M
Risk management . . . . . - .
9 Company data is breached during a disaster due to control failures. Business continuity and disa... Add
Vendors Company data is breached, corrupted or made unavailable due to a . .
malware attack. Operations security Add
Vulnerabilities
Compan Operations security Add ®
ORGANIZATION ~ P Successfully added recommended controls P


Editing notification settings

actions:
Editing & Updating
Turning On/Off

screenKeywords:
OVERVIEW ~ . po .
Settings My account notifications
Home
Tests COMPANY
Notifications
COMPLIANCE ~ My alerts
User permissions
Frameworks Receive an alert when certain events occur. Alerts will be batched and sent every 1 or 4 hours to avoid over-notifying you.
Roles
Controls
Information
Policies When an automated test | own needs attention
Security
el Billing [2 () When a document | own needs to be updated Email v
TRUST ~ Frameworks () When | am assigned ownership of an item Email v
Trust Report Language
i i () When a Trust Report access request is received (Sent immediately) Email v
Questionnaires
MY ACCOUNT
RISK ~ Notifications
Risk management Language Email digests
Vendors
_ () My assigned controls
Vulnerabilities
A weekly summary highlighting assigned security controls that need your attention.
ORGANIZATION ~
People () My Vanta Starter Guide progress
Computers A weekly summary highlighting your progress in the Vanta Starter Guide.
Inventory
() My company's progress
. Regular summaries that highlight compliance and security tasks needing attention.
Integrations
€3 Settings Send this email Weekly v = and include the following categories:
Product updates r Notification settings updated ®
Mobbin -
|vVanta < Settings My account notifications
COMPANY
Finish Starter Guide Notifications
—_— . My alerts
User permissions
15/22 tasks completed Receive an alert when certain events occur. Alerts will be batched and sent every 1 or 4 hours to avoid over-notifying you.
Roles
Q Go to... #+K Information
() When an automated test | own needs attention Email, Slack v
Security
OVERVIEW ~
Billing (7 () When a document | own needs to be updated SELECTED
Home .
E K Email
Tests rameworks () When | am assigned ownership of an item ALL
Language
COMPLIANCE ~ () When a Trust Report access request is received (Sent immediately) Slack
MY ACCOUNT
Frameworks
Notifications Clear
Controls
N Language Email digests
Policies
Documents
TRUST ~ () My assigned controls
A weekly summary highlighting assigned security controls that need your attention.
Trust Report
Questionnaires
() My Vanta Starter Guide progress
RISK ~ A weekly summary highlighting your progress in the Vanta Starter Guide.
Risk management
Access () My company's progress
Veralons Regular summaries that highlight compliance and security tasks needing attention.
Vulnerabilities Send this email Weekly v = and include the following categories:
®
ORGANIZATION ~ @ Human Resource
|vVanta < Settings My account notifications

COMPANY

Finish Starter Guide Notifications
- o My alerts
User permissions
15/22 tasks completed Receive an alert when certain events occur. Alerts will be batched and sent every 1 or 4 hours to avoid over-notifying you.

Roles

Q Go to... #+K Information
() When an automated test | own needs attention Email, Slack v

Security
OVERVIEW ~

Billing (7 () When a document | own needs to be updated SELECTED
Home .

F « Email
Tests rameworks () When | am assigned ownership of an item

Slack

Language
COMPLIANCE ~ @ When a Trust Report access request is received (Sent immediately) ALL

MY ACCOUNT
Frameworks

Notifications Clear m
Controls
ol Language Email digests

olicies
Documents
TRUST ~ () My assigned controls
A weekly summary highlighting assigned security controls that need your attention.
Trust Report
Questionnaires
() My Vanta Starter Guide progress
RISK ~ A weekly summary highlighting your progress in the Vanta Starter Guide.
Risk management
Access () My company's progress
Veralons Regular summaries that highlight compliance and security tasks needing attention.
Vulnerabilities Send this email Weekly v = and include the following categories:
®

ORGANIZATION ~ @ Human Resource
|vVanta < Settings My account notifications
COMPANY
Finish Starter Guide Notifications
- o My alerts
User permissions
15/22 tasks completed Receive an alert when certain events occur. Alerts will be batched and sent every 1 or 4 hours to avoid over-notifying you.
Roles
Q Go to... #+K Information
() When an automated test | own needs attention Email, Slack v
Security
OVERVIEW ~
Billing (7 () When a document | own needs to be updated Email, Slack v
Home
Tests Frameworks () When | am assigned ownership of an item Email, Slack v
Language
COMPLIANCE ~ () When a Trust Report access request is received (Sent immediately) Email v
MY ACCOUNT
Frameworks
Notifications
Controls
N Language Email digests
Policies
Documents
TRUST ~ () My assigned controls
A weekly summary highlighting assigned security controls that need your attention.
Trust Report
Questionnaires
() My Vanta Starter Guide progress
RISK ~ A weekly summary highlighting your progress in the Vanta Starter Guide.
Risk management
Access () My company's progress
Veralons Regular summaries that highlight compliance and security tasks needing attention.
Vulnerabilities Send this email Weekly v = and include the following categories:
®
ORGANIZATION ~ @ Human Resource
|vVanta < Settings My account notifications
COMPANY
Finish Starter Guide Notifications
- o My alerts
User permissions
15/22 tasks completed Receive an alert when certain events occur. Alerts will be batched and sent every 1 or 4 hours to avoid over-notifying you.
Roles
Q Go to... #+K Information
() When an automated test | own needs attention Email v
Security
OVERVIEW ~
Billing (7 () When a document | own needs to be updated Email, Slack v
Home
Tests Frameworks () When | am assigned ownership of an item Email, Slack v
Language
COMPLIANCE ~ () When a Trust Report access request is received (Sent immediately) Email v
MY ACCOUNT
Frameworks
Notifications
Controls
N Language Email digests
Policies
Documents
TRUST ~ () My assigned controls
A weekly summary highlighting assigned security controls that need your attention.
Trust Report
Questionnaires
() My Vanta Starter Guide progress
RISK ~ A weekly summary highlighting your progress in the Vanta Starter Guide.
Risk management
Access () My company's progress
Veralons Regular summaries that highlight compliance and security tasks needing attention.
Vulnerabilities Send this email Weekly v = and include the following categories:
Notification settings updated ®
ORGANIZATION ~ (9]