Document uploads

Complete the remaining evidence requirements to be audit-ready

Overview

By this stage of our Vanta Velocity Playbook, you should have connected your systems, generated and loaded your policies, completed the risk assessment and vendor risk activities. Now it's time to complete the remaining audit checklist of evidence items.

 

Sample Requirements

Type 1: If you are working to a Type 1 audit, you can provide any one example of the control, or a template or mock-up if a live example has not been performed yet.

Type 2: If you are conducting a Type 2 audit, AssuranceLab will provide you the sample selections from the populations in Vanta. For each of the selected samples, provide the evidence listed below in the table.

 

Audit checklist

The remaining items for the audit are described in the table below per Vanta control. The requirement column explains the expected audit evidence. You can click the control title to read more including the minimum expectations, better practices, and further explanation of each compliance control. 

 
Title Ref Requirement

Commitments Externally Communicated

PRM-1 Evidence of standard terms of service (website) or a contract template that's used to agree terms with customers and users.

Incident Response Plan Tested

IRO-1 Meeting minutes or documented test results from the incident response test.
Penetration Testing IAO-2 The latest penetration test report or SOW for planned penetration test (Type I only)
Performance Evaluations Conducted HRS-6 The completed performance evaluation evidence for the Sampled Employees.

Risk Assessment Performed

RSK-2 The latest risk assessment in the form of the risk register, meeting minutes, and/or a risk report.
Background Checks Performed HRS-1 The background checks conducted for the Sampled New Hires.
Continuity and Disaster Recovery Plans Tested BCD-2 Documented tests conducted and results for the business continuity and disaster recovery review exercises.
Board of Directors Charter GOV-2 Documented Board of Director terms of reference, responsibilities and/or scope.
Board of Directors Meeting GOV-4 The latest Board meeting agenda and minutes, with evidence of briefing on information security.
Control Self-Assessments Conducted IAO-1 Records of review of the controls in Vanta by the control owners, including any corrective actions or modifications identified.
Cybersecurity Insurance Maintained BCD-3 The certificate of currency or cyber insurance policy details.
Incident Management Procedures Followed IRO-3 Evidence of incident logging, classification, resolution and lessons learned devised for the Sampled Incidents.
Roles and Responsibilities Defined GOV-10 The documented job descriptions for the Sampled Employees.
Organizational Structure Documented GOV-8 The documented organization chart with roles and reporting lines. 
Access Reviews Conducted IAC-7 The latest access control review that confirms user access to critical systems is appropriate, or modified accordingly.
Vulnerabilities Scanned and Remediated VPM-2 The latest vulnerability scan report(s) or system record showing when they were conducted and the results.
Security Awareness Training SAT-1 Confirm security training is tracked in Vanta, or manually upload evidence for the Sampled New Joiners.
Access Requests Required IAC-9 The completed onboarding checklist or access approval for the Sampled New Joiners.
Access Revoked Upon Termination IAC-8 The completed exit checklist or other confirmation of access removal for the Sampled Terminated Employees.

Added Processing Integrity or Privacy to you audit scope? Contact us for guidance on the additional scope areas.