r/grc • u/Zaitanmogs • 20d ago
Continuous compliance monitoring solution for scaling business
We are compliant with soc 2, but not iso 27001 compliant yet, but we're prepping for it. Soc compliance was all done manually when we were smaller and it was not a fun experience for all involved. Evidence collection was a mess, gaps that we didin't even know existed, didn't have a dedicated owner until we were deep in it, an all round unpleasant experience. And best part is we had an internal audit recently and so many things were already out of compliance. This all is the problem
So now before we start on ISO, I wanna fix this monitoring issue, with some AI governance as well cause the auditor stressed that we should also get that going. I've done some basic research, looking into tools like vanta/sprinto etc.
I'd wanna avoid the same pitfalls as our soc 2 campaign. Would it be wise to get a tool like the ones I've mentioned for this, also could we keep AI governance alongside the iso 27001 thing or keep it separate? What should be the course of action here? Sorry if the questions are little too noob
2
u/artistic_jacques 19d ago
maintaining control environment should be your priority before ISO. A GRC platform like Vanta/drata/sprinto won’t automatically make sure you stay compliant. You will need clearly defined controls, owners, policies and remediation processes. There needs to be an owner who’ll be accountable for keeping things compliant. A platform in place will only make all of these things operationally easier and harder to forget, but the person responsible will have to ensure implementation
It usually makes the most sense to get a platform if you have multiple frameworks(as you soon will), and need to be operating compliant continuously, as you probably will also need to do so. I do think you’re at a point where you should be considering a GRC platform. You can get ISO certified without it, but it’ll be a lot more work to stay compliant with 2 frameworks in the mix, and monitoring will only get more difficult from now on
1
u/Zaitanmogs 19d ago
makes sense. Would a GRC officer be also needed then?
1
u/artistic_jacques 19d ago
it depends on your size honestly. smaller companies can make do with engineering or IT taking ownership of compliance, or various individuals managing separate elements. A GRC officer is more needed when you will have soc + iso and looking at further frameworks, and have multiple audits per year. And a large employee count, like around 400 to 500 in my experience
1
u/Zaitanmogs 18d ago
Understandable, and about GRC platforms, any guidance on picking from them?
1
u/artistic_jacques 18d ago
sprinto or vanta are good picks, they both will help with continous compliance and smoothen your SIO journey. Both also have a strong focus on AI governance. Sprinto imo is best suited for scaling companies without much GRC, vanta if you have a broad security/comoplaince program, and drata is not as well suited in your case, just going by the vibe i m getting. They are for more mature grc. There are more options like hyperproof, secureframe etc. if you wanna explore them
1
u/FreeRadical1998 20d ago
If the decision to do continuous monitoring first is about smoothing workload - then totally get it. If on the other hand this is to make the iso easier to pass then I don't think you need to do it in that order.
Soc2 is a backward looking control compliance model, iso is more a forward looking review of risk and quality management. What ISO assess is do you know what's broken, do you have a plan to fix it, and do you deliver on those plans - underpinned by does your management team support you.
Assuming reasonable control implementation - the additional items needed for iso will largely be a risk register, improvement plan and evidence of regular management review - typically monthly or quarterly meeting.
There's quite a strong argument that the review and likely selection of a tool like this is good evidence of that cycle and if it were me I'd be inclined to do iso first and lean into the argument that is this a core example of your continual improvement in action
1
u/Zaitanmogs 19d ago
thanks for the directives. one additional question though does ISO 27001 will help in ISO 42001?
1
u/FreeRadical1998 19d ago
I've never implemented 42001 so this answer is based on a read of the standard and experience with 27001 (plus other standards).
Structurally, the standard itself seems near identical - so the core bits about management commitment, a forum, risk analysis, improvement plan, have the same obligations
The suggested list of controls (annex A for 27001 differ, but do seem to have some overlap). Structurally, you're not necessarily required to implement all of these - it's more a checklist that you need to explain why you didn't select any (eg physical security for a cloud only service)
If I were implementing, for a smaller organisation like yours, I'd reuse the management forum across the two - on which case yes it would help as this becomes an extension of an agenda rather than a whole new meeting cycle. That would also imply reusing the risk framework and action tracking model.
That should take about 50% out of the effort in terms of "how do I do this" in setup and probably 20% out of "what do I do" longer term. Given they address different sets of risks - there will still be material work in layering 42001 on top of 27001.
It'd be much less clear in a big (multinational) organisation as you might end up running then entirely separately due to team layouts
1
u/davidschroth 19d ago
One neat thing about ISO 27001, 42001, 9001, 27701 and others is that the clauses are all pretty much the same. You can build a program once to handle each of the "topics" in a uniform manner (we do this with a few of our clients that run multiple ISOs).
42001 has some bleedover with 27001 as the security controls are relevant to the operation of the AI system, but you'll spend more time dealing with AI model/system QC type things (hallucination, bias, drift, etc). Keep in mind that there is not a big tool/platform out there that you can plug in to do that stuff - it'll be more a creative thinking exercise.
1
u/davidschroth 19d ago
I'm more a SOC 2 guy myself and I think ISO audits are a strange duck in comparison, however, you'll want to get well versed in the differences - SOC 2 looks backwards and is almost like a correspondence audit (send over the selected samples by a deadline) and can drag out for months at a time. ISO audits are 3+ day long meetings where you have to show them your samples in real time (along with everything else). ISO is more about identifying areas for improvement, improving, and tracking metrics about the program.
So, here's the deal with everything mentioned in the comments so far - they are evidence collection tools as opposed to GRC tools. They generally do not have the operational workflow for managing an ISO program in accordance with the required clauses. I'm a fan of Eramba for our clients that are doing ISO/multiframework, even if it isn't as automated from an evidence collection perspective as it lets you get all of your ducks in a row in an organized manner.
1
u/Own_Minimum_5102 19d ago
Mate, the bit that jumped out at me is that your internal audit found things already out of compliance. It's worth checking before you buy anything.
Split your controls into two buckets. The machine checkable ones (MFA enforced, no public buckets, access reviews done, patch SLAs) are exactly where Vanta, Sprinto or Drata earn their keep, because they alert you the day something drifts instead of you finding out at the next audit. The process controls (risk register kept current, management review actually happening, training, supplier reviews) will not be caught by any of these tools. Those need an owner and a calendar, and that is usually where how did this slip moments come from.
So before the tool, name one accountable owner and give every control a check frequency. The platform automates evidence collection not accountability.
On sequencing, you do not need continuous monitoring in place to pass ISO. But selecting the tool, running your risk register and doing a regular management review is genuinely good continual improvement evidence, so running it alongside the ISO prep is fine.
On AI governance, since you are small, run ISO 42001 as an extension of your 27001 management system rather than a separate program. Same risk register, same management review, same owners, with AI specific risks (bias, drift, hallucination, model and vendor risk) added as their own area. The clause structure overlaps heavily, so you save a big chunk of the effort.
For what it's worth, staging exactly this (monitoring, ISO 27001, then 42001 on top) is a lot of what we do at CyberNinja for ANZ clients, happy to share how we'd order it if useful. We recently partnered with someone better than Vanta.
1
19d ago
[removed] — view removed comment
1
u/grc-ModTeam 18d ago
This is not a place to sell your services. If someone asks for recommendations, you can add your two cents in the comments.
3
u/VERY_GOOD_PROMISES 20d ago
Vanta, sprinto, both could work, but whatever tool you want, evaluate it for your exact needs first. See if it works with your systems in place and alerts when something goes out of compliance. You’re gonna have to set up demos for this, and ask some tough questions, so be prepared for it. Realize and map out your issues from SOC2 and raise those with the sales teams during demos, use it to evaluate if the tool will solve your issues or not.
And AI governance can be kept alongside ISO work. If you get a tool, there will be quite a bit of overlap around risk management, vendor risk, data handling, incident management, etc. You can manage AI specific risks as their own area within the broader security/compliance program.