{"version":"0.8.0","built_at":"2026-10-11T17:54:56.537Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","product":{"id":"PR-350","name":"Vanta","vendor":"Vanta Inc.","category":"Compliance automation and trust management","description":"A cloud service that connects to an organization's cloud, identity, HR and code systems to test security controls continuously against frameworks such as SOC 2, ISO 27001 and HIPAA, collect audit evidence, and share the results with customers and auditors. Sold as subscriptions by framework and module.","website":"https://www.vanta.com","license_model":"subscription","deployment":["saas"],"aliases":["Vanta Trust Center","Vanta Trust Management Platform"],"csdm_note":"One Business Application for the tenant with a production Application Service; its read-only integrations to cloud, identity and HR systems are modeled as dependencies so a change to those connections is visible in impact analysis.","product_capabilities":[{"id":"PC-350.10","name":"Frameworks and Controls","description":"A shared control set mapped across supported frameworks, so one control can satisfy requirements in several certifications and gaps are visible per framework.","business_capability_ids":["BC-1270.10.10","BC-140.10.10"],"maturity":"core","business_capabilities":[{"id":"BC-1270.10.10","name":"Control Framework Management"},{"id":"BC-140.10.10","name":"Obligation Inventory"}]},{"id":"PC-350.20","name":"Continuous Monitoring","description":"Automated tests run through integrations that check configurations, accounts and devices against controls and collect the passing results as evidence.","business_capability_ids":["BC-1270.10.20","BC-760.10.30","BC-140.40.20","BC-760.40.40"],"maturity":"core","business_capabilities":[{"id":"BC-1270.10.20","name":"Continuous Evidence Collection"},{"id":"BC-760.10.30","name":"Security Control Testing"},{"id":"BC-140.40.20","name":"Compliance Testing"},{"id":"BC-760.40.40","name":"Cloud Security Posture"}]},{"id":"PC-350.30","name":"Audit Collaboration","description":"Auditor access to scoped evidence and control status, with failing tests and requests tracked to an owner until resolved.","business_capability_ids":["BC-1270.10.30","BC-140.40.30"],"maturity":"strong","business_capabilities":[{"id":"BC-1270.10.30","name":"Audit Coordination"},{"id":"BC-140.40.30","name":"Compliance Issue Remediation"}]},{"id":"PC-350.40","name":"Policy Management","description":"Policy templates, approval and versioning, with employee acceptance tracked as part of onboarding and on a recurring cycle.","business_capability_ids":["BC-760.10.10","BC-140.20.10","BC-140.20.30"],"maturity":"strong","business_capabilities":[{"id":"BC-760.10.10","name":"Security Policy & Standards"},{"id":"BC-140.20.10","name":"Compliance Policy Development"},{"id":"BC-140.20.30","name":"Attestation & Certification"}]},{"id":"PC-350.50","name":"Security Awareness Training","description":"Assignment and completion tracking of security and privacy training for personnel, either built in or recorded from a connected training provider.","business_capability_ids":["BC-760.10.40","BC-140.20.20"],"maturity":"partial","business_capabilities":[{"id":"BC-760.10.40","name":"Security Awareness"},{"id":"BC-140.20.20","name":"Compliance Training"}]},{"id":"PC-350.60","name":"Trust Center","description":"A public or access-gated page that shares certifications, policies, subprocessors and live control status with prospects and customers.","business_capability_ids":["BC-1270.20.10","BC-1270.20.30"],"maturity":"strong","business_capabilities":[{"id":"BC-1270.20.10","name":"Trust Center Publishing"},{"id":"BC-1270.20.30","name":"Customer Audit Support"}]},{"id":"PC-350.70","name":"Questionnaire Automation","description":"Drafts answers to incoming security questionnaires from a library of approved answers and existing documentation, with reviewer sign-off.","business_capability_ids":["BC-1270.20.20"],"maturity":"strong","business_capabilities":[{"id":"BC-1270.20.20","name":"Questionnaire Response"}]},{"id":"PC-350.80","name":"Vendor Risk Management","description":"An inventory of vendors with risk tiering, security reviews of documents they provide, and reassessment reminders.","business_capability_ids":["BC-760.60.10","BC-640.40.10","BC-640.40.20"],"maturity":"strong","business_capabilities":[{"id":"BC-760.60.10","name":"Supplier Security Assessment"},{"id":"BC-640.40.10","name":"Supplier Risk Tiering"},{"id":"BC-640.40.20","name":"Continuous Risk Monitoring"}]},{"id":"PC-350.90","name":"Access Reviews","description":"Periodic campaigns in which owners confirm or revoke user access in connected applications, with the decisions retained as evidence.","business_capability_ids":["BC-760.20.30"],"maturity":"strong","business_capabilities":[{"id":"BC-760.20.30","name":"Access Governance"}]},{"id":"PC-350.95","name":"Risk Management","description":"A risk register with likelihood and impact scoring, treatment decisions and links from each risk to the controls that address it.","business_capability_ids":["BC-760.10.20"],"maturity":"partial","business_capabilities":[{"id":"BC-760.10.20","name":"Security Risk Assessment"}]},{"id":"PC-350.97","name":"Vulnerability Management","description":"Collects findings from connected scanners and code repositories and tracks each against a remediation deadline set by severity.","business_capability_ids":["BC-760.40.10","BC-1270.40.20"],"maturity":"partial","business_capabilities":[{"id":"BC-760.40.10","name":"Vulnerability Management"},{"id":"BC-1270.40.20","name":"Triage & Remediation"}]}],"page_url":"https://catalog.mikereams.com/products/PR-350"}}