Andy S.

Commented on Anyone have a good template for risk acceptance si...·Posted inGRC

I'm actually dealing with the same situation regarding risk acceptance 😅. Trying to design something that covers us. Might have something in a few weeks

Commented on Hello Everyone, our team is building out our Vendo...·Posted inGRC

Andy S.

No problem, Andrew. See responses below -

When you say “upload the vendor’s security and compliance docs”, are you separately obtaining materials from the vendor trust center for outside the assessment? I do a little of both - First, I include the "evidence" I'd like to receive as part of the assessment within Vanta. A few things occur here: 1) Not all vendors have trust centers and they typically require you to request access before you can obtain them. This becomes a manual step and I obtain them directly via Trust or email 2) Not all vendors provide all of the necessary documentation we're looking to see.

For our org, since we're in a regulated industry, there's some additional due diligence that is required.

How do you populate the Vendor Point of Contact? Is that a manual lift or do you have integration with a contract management repository (possibly GDrive)? This is definitely a limitation within Vanta - but I have a series of questions that exist in my Jira intake, one that includes a POC for the vendor that's being procured. This is a requirement I put on the business to collect. For those where no contract is done, contacting support becomes the alternate route or we work with what's available and place some additional controls internally.

It’s interesting you download the responses from Vanta and combine with internal documentation. Are you able to provide some further insight into this part of your workflow? Why would you want to pull this data out of Vanta? Vanta is capturing the general vendor info, but what I want is the actual business justification or use case for how the business intends to use the service. We care about how our data will be handled and how it intends to flow across the environment. Vanta doesn't capture the responses from the business (this is feature request I've already pushed for).

In my ideal state, I'd like to map Jira responses to custom fields in Vanta and/or allow for additional internal documentation to be uploaded to Vanta for the AI agent to build a solid profile of the vendor.

Commented on Hello Everyone, our team is building out our Vendo...·Posted inGRC

Andy S.

Hey Andrew K., happy to share a quick overview of what I've been doing. I've stood up my VRM program by leveraging multiple systems that are all connected. My workflow leverages some automation and consists of Jira > Vanta > Claude > GDrive + Asana I built my workflow around Jira as the intake and communication mechanism that captures the request from the business. That request then pushes to Vanta as a new procurement record. I use Vanta to upload the vendors security and compliance docs. From Vanta, I send out invites to the vendor point of contact to request any additional or missing evidence to assist with our review. While I do have Vanta AI enabled, I don't rely solely on it's output and keep a human-in-the-loop approach. I still require the vendor to respond to some of our questions and review it against the source material Vanta AI has found. Once the questionnaire is complete, I download the responses to combine it with our internal documentation for how the vendor will be used internally to draft up the risk assessment. Depending on your industry, use case, program maturity, I would actually consider using Vanta's intake feature that's already baked into the tool. Unfortunately, when I started building, it didn't exist.

Commented on How to View Full Answers in Knowledge Base Without...·Posted inProduct Updates

Andy S.

Actually this is the same in other areas such as the Vendor "Decision Summary" too. That's the only other I can recall at the moment.

Commented on Manage the Full DSAR Lifecycle Directly Inside Van...·Posted inProduct Updates

Andy S.

I have questions ✋🏽

1.
Can we load past ones easily from a CSV or sheet?
2.
Will there be an email interface or connection to respond or where we can forward the incoming request email to vanta and it auto creates a ticket for tracking?

Commented on Vanta TPRM Questionnaire Builder Upgrade: Smarter...·Posted inProduct Updates

Andy S.

(edited)·

Found where to download. You have to go to Activity within the Summary page and then you can see the file. Also, appears under the Evidence. I missed that one!

Commented on Vanta TPRM Questionnaire Builder Upgrade: Smarter...·Posted inProduct Updates

Andy S.

Thanks for kicking off that email! Re: #1 - Just shared some feedback via email with issues I'm seeing with this piece. The assessor is unable to click, download, or view the attachments submitted by the vendor. I think the assessors should also have the ability to add attachments within the console as well because if we're conducting a self-review on a vendor internally, we need to be able to submit any attachments. Does that make sense? Also, just going to add a feature request to this piece because it would be great if there was a way to see which questions have attachments included within this view. Another button or within the table where you can see attachments and download as needed. 😅

Commented on Dark Mode Now Available in Vanta: How to Enable an...·Posted inProduct Updates

Andy S.

Love this!!

Commented on Vanta TPRM Questionnaire Builder Upgrade: Smarter...·Posted inProduct Updates

Andy S.

Hey Jacob G. loving the latest questionnaire builder updates! I just went through and made some updates to our questionnaires. Now if only we can go a layer deeper with conditional logic and have that expand to more field types! But that'll do for now! Also, I'm not sure where to relay this, but I noticed a UI improvement with the Assessments, but now I'm noticing two issues:

1.
I'm not seeing the ability to request evidence within a single question in the questionnaire? Am I looking at this in the wrong place?
2.
I noticed that Vanta AI is no longer able to recommend a better answer or modify a response when editing a response. Previously, we were able to do so.

Any ideas?

Commented on Row-Level Tagging Now Available for Answer Library...·Posted inProduct Updates

Andy S.

For sure. Thank you as well for being the voice on behalf of your customers! I would say that one-liner does capture what we're looking for. 🙂

About

Trust Center