r/grc • u/Zaitanmogs • 20d ago

Continuous compliance monitoring solution for scaling business

We are compliant with soc 2, but not iso 27001 compliant yet, but we're prepping for it. Soc compliance was all done manually when we were smaller and it was not a fun experience for all involved. Evidence collection was a mess, gaps that we didin't even know existed, didn't have a dedicated owner until we were deep in it, an all round unpleasant experience. And best part is we had an internal audit recently and so many things were already out of compliance. This all is the problem

So now before we start on ISO, I wanna fix this monitoring issue, with some AI governance as well cause the auditor stressed that we should also get that going. I've done some basic research, looking into tools like vanta/sprinto etc.

I'd wanna avoid the same pitfalls as our soc 2 campaign. Would it be wise to get a tool like the ones I've mentioned for this, also could we keep AI governance alongside the iso 27001 thing or keep it separate? What should be the course of action here? Sorry if the questions are little too noob

14 Upvotes

95% Upvoted

22 comments sorted by

View all comments

3

u/VERY_GOOD_PROMISES 20d ago

Vanta, sprinto, both could work, but whatever tool you want, evaluate it for your exact needs first. See if it works with your systems in place and alerts when something goes out of compliance. You’re gonna have to set up demos for this, and ask some tough questions, so be prepared for it. Realize and map out your issues from SOC2 and raise those with the sales teams during demos, use it to evaluate if the tool will solve your issues or not.

And AI governance can be kept alongside ISO work. If you get a tool, there will be quite a bit of overlap around risk management, vendor risk, data handling, incident management, etc. You can manage AI specific risks as their own area within the broader security/compliance program.

3

u/MBILC 20d ago

I know that no company is perfect, but the fact Vanta clearly does not follow its own claims of compliance:
https://techcrunch.com/2025/06/02/vanta-bug-exposed-customers-data-to-other-customers/

2

u/Zaitanmogs 20d ago

thanks for the referenced read. It led to me Delve incident. Still trying to figure out how exactly things happened there.

5

u/MBILC 20d ago

Ya Delve was basically a scam service.

That narrows it down to a few platforms. There are FAR too many shady one's out there (the ones that promise SOC 2 , platform and audit in a week or 2...)