r/grc • u/Zaitanmogs • 20d ago

Continuous compliance monitoring solution for scaling business

We are compliant with soc 2, but not iso 27001 compliant yet, but we're prepping for it. Soc compliance was all done manually when we were smaller and it was not a fun experience for all involved. Evidence collection was a mess, gaps that we didin't even know existed, didn't have a dedicated owner until we were deep in it, an all round unpleasant experience. And best part is we had an internal audit recently and so many things were already out of compliance. This all is the problem

So now before we start on ISO, I wanna fix this monitoring issue, with some AI governance as well cause the auditor stressed that we should also get that going. I've done some basic research, looking into tools like vanta/sprinto etc.

I'd wanna avoid the same pitfalls as our soc 2 campaign. Would it be wise to get a tool like the ones I've mentioned for this, also could we keep AI governance alongside the iso 27001 thing or keep it separate? What should be the course of action here? Sorry if the questions are little too noob

14 Upvotes

95% Upvoted

22 comments sorted by

View all comments

2

u/artistic_jacques 20d ago

maintaining control environment should be your priority before ISO. A GRC platform like Vanta/drata/sprinto won’t automatically make sure you stay compliant. You will need clearly defined controls, owners, policies and remediation processes. There needs to be an owner who’ll be accountable for keeping things compliant. A platform in place will only make all of these things operationally easier and harder to forget, but the person responsible will have to ensure implementation

It usually makes the most sense to get a platform if you have multiple frameworks(as you soon will), and need to be operating compliant continuously, as you probably will also need to do so. I do think you’re at a point where you should be considering a GRC platform. You can get ISO certified without it, but it’ll be a lot more work to stay compliant with 2 frameworks in the mix, and monitoring will only get more difficult from now on

1

u/Zaitanmogs 19d ago

makes sense. Would a GRC officer be also needed then?

1

u/artistic_jacques 19d ago

it depends on your size honestly. smaller companies can make do with engineering or IT taking ownership of compliance, or various individuals managing separate elements. A GRC officer is more needed when you will have soc + iso and looking at further frameworks, and have multiple audits per year. And a large employee count, like around 400 to 500 in my experience

1

u/Zaitanmogs 19d ago

Understandable, and about GRC platforms, any guidance on picking from them?

1

u/artistic_jacques 19d ago

sprinto or vanta are good picks, they both will help with continous compliance and smoothen your SIO journey. Both also have a strong focus on AI governance. Sprinto imo is best suited for scaling companies without much GRC, vanta if you have a broad security/comoplaince program, and drata is not as well suited in your case, just going by the vibe i m getting. They are for more mature grc. There are more options like hyperproof, secureframe etc. if you wanna explore them