Drata vs Vanta for SOC 2: What Actually Matters

Ali: Hey, this is Ali from TRUVO Cyber. Today I'm sitting down with Gilliano, who works with Drata day in and day out on SOC 2 implementations. We're going to do something a bit different today. Instead of me telling you what Drata does, I wanted to get someone who's actually in the tool every day to walk us through it. So Gilliano, thanks for jumping in. Before we dive in, tell us a little bit about yourself, what you do, and how you ended up working with Drata so much.

Gilliano: Thank you so much for having me. I'm a SOC 2 analyst. I spend most of my time really just inside of Drata and setting up frameworks for companies, primarily SOC 2 of course, and a lot of my work is spent monitoring and seeing how things are going for companies. For example, you see there's a couple of frameworks here; the most relevant to me is SOC 2 and you can monitor their readiness in Drata.

Ali: Perfect. So here's what we are going to do: we're going to walk through Drata the way you would actually use it after you bought the platform, paid for a license, and everything is ready to go. First we do the login, integrations, controls, evidence, the whole workflow really. I want people watching this to get a realistic picture of what they are signing up for so they know what to expect. If it sounds good, we can get started.

Gilliano: Yeah, so let's get into it.

Ali: So let's say someone just bought Drata. What is the first thing they will see when they log in?

Gilliano: Well, typically there is usually a getting started page. It makes it really simple to go through the steps, but I will show it from where we are now, where we have a staged environment. So, first thing I would do is you would have your account here. Click here. I would go to settings and you'd see company settings. The first thing I'd go to is company settings where I'd go to company info and I would fill the information here. Once it loads, I'd show you. Yeah. So, we go here. We'd fill out all of the company's details, you know, everything. And I'd set up a workspace. Now what a workspace is, is you're basically setting up an environment for a specific assessment and you could pick out a couple of frameworks. In this case the most relevant one for me would be SOC 2. So I would pick out a framework, design what I would be doing in this workspace and a bit of a description. Right. I won't pick one here because we have a few in draft. Okay. Right. And there's one more thing I would do. I also go to connections and I would set up the main identity connection first.

Ali: Right. So you start off with identity first.

Gilliano: Yeah. So I would set up the workspace to pick your framework and then set up your identity.

Ali: Why is that important? Why would we start with identity and not something else?

Gilliano: Because identity really gives you an idea of all the personnel you have working for the company. And one of the things you start with is assigning policies. So you would want all the people to be in here as well so you could govern your personnel.

Ali: So yeah. So it syncs the user information from your identity source to Drata. So then you can assign policies, acknowledgements, training, that sort of thing to them.

Gilliano: Yes, exactly.

Ali: Okay. Okay. Okay. Sounds good. And then what sort of integrations are available? I see quite a list.

Gilliano: Yeah, this is a great opportunity to talk about that. So Drata offers a very wide range of different integrations. You can see just for identity, there's already seven or eight here. These are some of the options and you can do manual imports as well, but you could also do things like your automation tools, things you use for your codebase, observability. So there's really a wide range of connections and integrations that you could use.

Ali: Okay. Okay, that's great. Can we explore a couple more categories like what are the popular ones? So we've gone through IAM, identity access management, the main cloud platforms.

Gilliano: Yeah, the main cloud for SOC 2 infrastructure. So you'd see things like Azure, AWS, GCP, those I see quite often. In terms of ticketing I see here, a lot of people use Azure Boards, DevOps, Jira. So you see a lot of the big names are popping out here and even for version control, we do have a lot as well, Azure Repos, GitHub. So a wide range of options.

Ali: Okay. Okay, sounds good. And then how about like HR stuff?

Gilliano: Yeah, there we go. So these are the sort of integrations that are there.

Ali: And why why would we need to sync our HR system with Drata?

Gilliano: Now that's a really common one. It depends on what you're using for your workspace, but when it definitely comes to things like signing off on background checks and things like that, sometimes that's often uploaded through your HR platform and it could grab a lot of that info from there and have it imported automatically.

Ali: Okay. Okay. So when someone, I guess this could be helpful for onboarding and offboarding, making sure that people are properly, when they get onboarded they get assigned to training, security training and policy acknowledgement, and offboarded from the HR, their access is removed from all other integrated systems on time, correct?

Gilliano: Exactly, and that's one thing that really comes up quite often because it's a lot of overhead to not only have to do the paper-based part of it but also have to bring it into Drata after. This makes it really easy and simple.

Ali: Yeah, access management is such a big part of any cybersecurity framework because it touches every system. It's always in flux, right? People always joining, leaving the company, changing roles, or new systems come in, you need to assign them properly. So it would be nice to have everything centralized so you have a central command for viewing whats happening. This is great. How about endpoint management? What kind of coverage do they have for anti-malware or MDM perhaps?

Gilliano: Yeah, so they have a wide range of options there. Intune is definitely my favorite because I tend to work with a lot of Azure environments to pull a lot of information for endpoint detection, especially if you want to use policies because if you have compliance policies in place it could also check to see, "Hey, are these devices compliant? Do they adhere to things like, for example, a lot of people have their BitLocker enabled so that your disk could be encrypted," it can pick up all of that and make sure that they adhere to those things.

Ali: No, this is actually one of my favorites too. It really gives you good visibility on configurations that your endpoints have, right? So the actual configurations are pushed from Azure in this case.

Gilliano: Correct. Yeah.

Ali: But then you have evidence for your compliance pulled from Azure here. So you can show the auditor that you're monitoring your endpoint in real time and have all the evidence in one spot.

Gilliano: Exactly.

Ali: That's really good. Yeah. So test configuration, I think with Intune you can probably do the, I know you can do the anti-malware monitoring as well, right? To making sure that malware agent is installed, right?

Gilliano: Yeah. You could ensure that all those endpoint detection and response mechanisms are in place, and if they are in place and they scan for antiviruses it can make sure that these are passing those scans.

Ali: So that's a really good overview of the integrations. Um let's move on to what the integrations actually mean. So of course we know integrations are there to automate stuff. Can you show us the impact of those integrations on our dashboard and control status?

Gilliano: Yeah. So if we go to our dashboard here, I think this is a good place to get an idea of how it works because when you go to your readiness, you'd see that, hey, this one for example, SOC 2 is on 24% readiness. And how you would see the effect of using those integrations is after you set up your workspace with SOC 2, do your integrations, you'd see that a lot of these are automatically populated, right? So if I click on the framework, you'd see that you have a number of controls and a lot of them have things like automated monitoring. One of the big ones that I see come up quite often is MFA.

Ali: Mhm. Right.

Gilliano: So, for example, MFA for remote access. Does this one have the monitoring set up? Okay, hold on one second. I'll go straight to the monitoring tab. Yeah. So, if you go to MFA, you can see all of these active connections actually show up quite often. And this is how all those integrations help. Once it's connected, there are a number of automated monitorings that come up. It'll check your infrastructure using the API setup and it's just constantly monitoring those and saying, "Hey, does this person have this enabled?" And it'll automatically populate in your Drata rather than you having to input that information manually.

Ali: Yeah. Yeah. That makes sense. And then do you find that sometimes errors are made when Drata tells you something is green, the test is green, where it's really not in place, or the other way around, tells you that something is not in place but it is actually in place and you need to adjust something?

Gilliano: It doesn't happen too often in terms of these controls. There are some instances, but in most cases the automations that are there work quite well, trigger correctly, and pull in the information. If it is a case where some information isn't pulled in correctly, you could always go to the control, go to the monitoring tab and it'll say, "Hey, this is passing because it's checking the policies that are in place." You can still go view the tests, see all of the details, and it shows you,

Ali: Sorry, does it show you the actual like a JSON response or API response?

Gilliano: Yeah, exactly. In this case, it won't have a JSON because this is for a policy. But if it did pull from Intune, for example, it would have the JSON saying, "Hey, this is all the information that was pulled in." And that way auditors can trust it a lot better because it'll have your infrastructure, your tenant ID, etc.

Ali: So one of the challenges I had with another platform, not with Drata, is that the out-of-the-box test was looking for Azure logging retention for 365 days, but whereas the company policy based on the risk appetite and all the other controls they have, they only wanted a 90-day retention policy that was our official stance. But we had challenges, so essentially we had to go and modify the default test. Is that something that we do in Drata? Do you need to create a custom test?

Gilliano: Yeah, that option is there. You can customize all of the tests that are in place. One of the biggest things that I find to be the best is when you go to monitoring, you could just create tests and you can make your own name and put in your own monitoring systems. And then all of the tests that are in place are easily toggable. We can turn them on and off, but also they can also change their criteria.

Ali: Correct.

Gilliano: Yeah, you could also change the criteria.

Ali: Yeah. So, let's kind of walk through the lifecycle. So, you know, got the platform, we set up the integrations. What is the next step? Do you find that you need to go through every control and make sure that the scope that control is fully kind of can be met by the out-of-the-box test or what does how does that look like? How do you get confidence that the automated integrations have the full coverage of what you need?

Gilliano: Right. In most cases the automated tests cover about 90% of what comes up for your audit. But to be sure when you do the audit you could view your frameworks and say, for example, you're doing an audit on SOC 2, it easily categorizes them into all your criteria. Then, for example, the first criteria A1.1, you could see all of the mapped controls. Right, by default these are the ones that are here. This one particularly contains the autoscaling, load balancers, system monitoring. And if it is that you do need another control because you find that what you have in place doesn't line up with this, you can always map different controls or remove the controls that are there.

Ali: So, it's easy to add, drop in a new control to meet specific criteria.

Gilliano: Exactly.

Ali: When you mentioned 90%, I assume your assumption is that the company is like 100% cloud-based and has integrations for all the key pieces in place.

Gilliano: Correct. Exactly. Yeah. I do assume that they have most of their things in a cloud-based environment. If it's something that's more on-prem, then you find yourself needing to do a bit more custom integrations.

Ali: What I find is with our engagement the number is about like 60-70% actually, and it's split actually between three different buckets. One is a technical test. Yeah, if you're cloud-based and most things are integrated with GRC platform, you can get most things automated after a bit of customization. And then you have another one-third that's not really automated but the GRC platform, like in this case Drata would help you implement, like a risk assessment or vendor risk review or those controls are implemented by using Drata, right? And then there's always what I find is about 30% that still needs manual evidence, either because they have on-prem or just the process itself is manual. Like, for example, the meeting minutes from the board, right? Or candidate competency review, right? So Drata cannot automate that, but you know you just drop the evidence that you're doing those things in here.

Gilliano: Correct. Okay. And the best way, I'll actually show off a bit about that as well because for those manual things that you have to enter, you could track that in Drata as well. You could just go to the evidence library and then say that you want to add an organizational chart, for example. Could add evidence, say org chart, give it an owner and add the artifact in. So in this case it would be a file and you could upload the image. You could link it to a control here. How I often do it is, instead of going to the evidence library, I would go to the control itself and say, "Acceptable use case policy evidence." There's no evidence here. Well, theoretically, there's no evidence here and we want to upload a specific piece of evidence. We just add the evidence and it'll automatically map to your control. That way, when you have, for example, a specific criteria you're trying to meet, the control itself has the evidence attached. So it passes the check and you don't have to worry about things like making sure things go to the right place.

Ali: Yeah. Yeah, that makes sense. And then can you do mapping of one evidence to multiple controls?

Gilliano: Yeah, of course. In that case, I would go to my evidence library and I would point it to multiple controls, or in the control section you could click here, "evidence." So then in the case where I wanted to map evidence to multiple controls, I would just go to controls and I would pick one. And because I added it to another control already, if I go to the evidence tab of this control, hit 'add evidence'. Instead of posting it, instead of having to upload it now, I could just hit 'evidence library', right? And this allows me to pick evidence that's already been uploaded. So that if I already uploaded a termination checklist or something like that and I need to use it for multiple controls, then I could just grab it from my evidence library rather than having to upload it multiple times.

Ali: And then in terms of some of the evidence needing to be refreshed, well, every evidence needs to be refreshed. But the ones that are manual, let's say you have quarterly refresh or annual refresh, it's easy to set up those kind of reminders and dates for the manual evidence.

Gilliano: Well, when you set them up, you tend to put them with a creation date. Okay. And in that case, you could view it that way. I think policies are a lot easier when it comes to viewing the expiry date because once you have policies in place, you have to set your approved dates, your publish date, and you could set an expiry. So, for example, the acceptable use policy. If I go to, sorry, if I go back to overview and details, often in your details, you'll see here you have a renewal date. You could either set that to a one-time date, you can set it to a year, 6 months. So depending on the criteria that you have set in place, for example, this needs to be reviewed annually. You could set it to one year and then it'll set the control to needs approval once that review date comes up. So that instead of having to try to figure out if it needs approval, it'll see.

Ali: Yeah, it's a good idea to explore that policy tab as well. Yeah. So let's talk about policies. So the out-of-the-box policies that Drata provides, are they, so how do they work? Can organizations just grab the base default policy there and just publish it, or do they need to kind of read, understand and figure out how how it applies to them, and maybe they need to make some modifications and then publish them?

Gilliano: In the first case, you definitely should review all of the policies because you want to ensure that all of these align with what your company has in place. And there's two ways to do this. You could either upload the policies that you already have or customize the ones that are in Drata, but it's something that you shouldn't neglect to check over just to make sure that they're okay and align with everything. These do adhere with a lot of the frameworks that are in place, but doing a once-over and doing some due diligence is important.

Ali: I find the hardest part for folks new to this process is translating the policy language into everyday workflow, right? Like, "I agree to this policy," but what does that mean on Monday morning on my actual daily operations?

Gilliano: Yeah, exactly. So that why I think the policies are something you definitely want to spend a lot of time with in the beginning because these policies really define how your company runs and how it's governed, and the auditors themselves would really be judging all the evidence and controls you have in place against your policies, right?

Ali: Yeah, so for example for change management, if you say that you need a ticket for every change that's put in place and you do that, you review those tickets annually or on a monthly basis, then you would need to show that evidence. So having the policy stating that is really important. SOC 2 specifically is very very flexible on the controls because it asks the company to define what's suitable for them, right? So in one sense it makes it easier, but the other sense is like it's a blank canvas, right?

Gilliano: Yeah, exactly. It can be intimidating to figure out, "Okay, what's the right thing to say here?" But I think platforms like Drata give you that structure, that framework policy, so you're not starting from scratch, but then you still need to make sure that the policy is suitable for your organization.

Ali: Yeah. Yeah, more stuff definitely. Okay. So let's move on to another topic. Many people at this stage are comparing platforms on competing framework platforms. You know there's Drata, Vanta, Secureframe, Scrut Automation. On the surface, they may all look very similar. So what do you think are the good ways for someone comparing Vanta versus Drata, for example, to find out the best fit for their organization, like from an implementation perspective? What would be your recommendation?

Gilliano: Yeah, from an implementation perspective, I think there are two real things that are the most important. One, I would say the connections, because the connections really make it really easy to get evidence for a lot of different things, and the connections that the platform offers may vary from platform to platform. So you want that box checked, right? And then the second part of that, I would say is really important, is the customizability. Because depending on your environment and the company that you're working with, they would have different needs. They might be on-prem, they might be hybrid, and you might have situations where you need to do something with an API or upload a JSON, and being able to say, "Hey, I'm going to create a new custom connection and say, 'Right, it's going to be using a JSON schema or it's going to be using an API key,'" is really important. Right. And this also goes for the controls that you have in place, because you might need a different control that isn't automatically here. You could create a new control in Drata, and that customizability is, I think, what sets the platforms apart and what you should consider.

Ali: Two really good points to kind of recap. First, you need to have an inventory of all your systems, right? Before you even go shopping, right? Create an image of what you have, and then one of your criteria for selecting a platform is to make sure there's a good overlap between what the platform out of the box supports and what the organization has, right? And then the other second point you made is customization, evaluating how customizable a tool is and whether or not you need it. Some organizations may not need a lot of customization, they'll be happy with more or less out of the box, but if you do need it, it's important to figure out if the platform gives you what you need from an engineering point of view.

Gilliano: Yeah, exactly.

Ali: Yeah, that's one of the strong suits from Drata, it really makes it easy to run those custom tests and controls.

Gilliano: Yeah, because there's just such a wide range of options to work with, spanning across a lot of different areas. It really makes it quite easy.

Ali: Once you set up that authentication, you have that API connection between Drata and the target system, then you can define various tests against that system, correct?

Gilliano: Exactly, yes.

Ali: Okay, so moving on to the next topic, multi-framework overlap. So many organizations start with one framework, typically SOC 2 if you're based in North America. If you are somewhere else in Europe or Asia, you might be starting with ISO 27001, but then you quickly realize different customers are asking you to do different things, so you start layering a second framework, third framework, and then you realize, "Oh my god, I need to be compliant with privacy frameworks too, like GDPR and HIPAA," and you know California has their own now, and it becomes quite a bit to manage. How does a platform like Drata help us on that front?

Gilliano: I actually think this is the best part of using a GRC platform, just because if you go to the frameworks tab here and you go to controls, you'd see that a number of these have percentages, and you don't have to have individual evidence for each control. The best part is the controls map to multiple frameworks. So when you're doing your uploads and you're working on SOC 2, you're actually working on all the other frameworks as well, because Drata allows all those controls to be mapped to multiple, and as you update for one framework, a lot of others get populated as well. And while security is something that tends to have a lot of overlap because there are just a few principles that you need to always have, and it goes for all the other frameworks. So if you say you just finished SOC 2 and you're ready to move on to ISO 27001, you'd already have a bit of a head start from all the controls you already uploaded.

Ali: Yeah. Yeah. All the evidence maps because at the root of it, all of these frameworks are asking the same thing, just different ways, right? You can see the mapping here very clearly. Out of curiosity, we specifically get asked this question a lot. Someone is compliant with two frameworks really that are the most popular right now, SOC 2 and ISO 27001. Is there a way to see how much overlap exists on this representative system for those two frameworks?

Gilliano: Oh yeah. As you come to the framework tab here, you'd see that you have the percentages for the ready controls. Okay. And as you click on them, for SOC 2 for example, you'd see that these number of controls are ready. These are all marked off by these numbers. So you'd see that here we have DCF95. These are all marked off. These same controls are the ones that would be linked to your other frameworks. So when you go over to ISO and you see the controls, the same numbers, sorry, the same control definitions is what is here as well. So you can see a lot of that overlap happening.

Ali: Okay. Okay. So it's the same. If I click on a single control, does it show it mapped to multiple frameworks?

Gilliano: Yeah. If you have the control, you have the tag for each framework. Yeah. It'll show you all the frameworks that it applies to. And this is also why setting up your workspace is so important, because the frameworks that show up here are only the ones that you selected in your workspace.

Ali: Okay. So for the demo purposes, these are the ones we selected. You can see that the controls are tagged by the frameworks that they apply to. Do we have ISO 42001 in this demo environment?

Gilliano: I'm not sure if it's set up in this; I know it wasn't selected for the workspace. Okay. But it should, oh, there we go. I think we just passed it. There you go. It just says 'learn more' and you could schedule a demo.

Ali: Okay. Okay. Yeah, we'd have to add it to the workspace to go into the details of it. Yeah. Then, so we've gone through the setup, integration, automated controls, manual controls. For someone watching this who just bought Drata, what is the gap between having the platform and actually being audit-ready? What does that workload look like? What do they need to do?

Gilliano: Yeah, I would say that the platform is really just a head start in terms of the starting point, because Drata kind of acts as your single source of truth for getting all of that information automatically. But it could only do so much in some cases. There's a gap where, depending on your company's policies, you may need to fill out some things manually. You may need to upload. So there's just a lot of information, especially with regards to customizing your policies and governing the personnel that you have because, for example, not all policies may apply to all personnel. So when you go into that policy center, one of the big things that you also have to do is say, "Hey, well, in the case of acceptable use policy, you may want it to apply to all personnel, but you may also need it to apply just to specific groups," right? So these are things that you also have to consider.

Ali: Yeah, a good example maybe would be a secure development policy, right? So you probably don't need the receptionist for the office or the admin assistant for the office, who never touch the production environment, to acknowledge the secure development policy, right?

Gilliano: Yeah. Yeah. Exactly.

Ali: Somebody has to think through all of those nuances.

Gilliano: Yeah, exactly. Someone has to really go in and dig into these policies and understand who they need to go to, what applies, and even in some cases, who also needs to review these policies. Because the policies span a lot of domains. Some are HR-related, some are software development lifecycle-related, some are just general staffing. So some of these need to go to a specific person for approval. And Drata also makes that pretty easy because in your approval section for your policies, you could select who reviews it from your personnel list.

Ali: No, thanks so much, Gilliano. This has been an amazing overview. I think people who are shopping around and looking for good GRC solutions will benefit from viewing this demo and having the voiceover from your end from a practical, practitioner point of view. So, much appreciate your insights. Do you have any final parting thoughts before I take us out of here?

Gilliano: Yeah. Just would have one thing to add, but thank you a lot for having me. I think one of the biggest things is that when you're approaching something like compliance, you really want to see it as more of an engineering problem now rather than just paper-based uploading. Because when you set a process in place, rather than just trying to hit one piece of evidence one at a time, it becomes a lot smoother to get through these audits.

Ali: That was, I would say, that's a golden insight out of this whole conversation. Compliance is not a project that you work on for two or three months and you're done. It is something you work on for two or three months to get set up and then continue doing forever to remain compliant. So you have to think how to make that workload a lot easier on your staff, and a big part of that is setting up the automation as much as possible.

Gilliano: Thanks for sharing that. Yeah.

Ali: Folks, I hope you find this useful. I know I benefited from this a lot. So, thanks for watching. If you think this is of interest, but you think it's a lot of work and you may not have internal capacity to go through all this build process and translating all the policies into practical day-to-day operations or setting up the custom tests and being actually audit-ready, have the confidence to be audit-ready, and you think you might need some help, you feel free to reach out. We structure our engagements into three phases: Assess, Build and Operate. In the assessment phase, we come in, we do deep discoveries. We figure out what systems you have, how you work, lines of business. We establish the audit boundary for your organization, making sure that all controls that come out of the box, as Gilliano showed, make sense in your organization and what those controls mean on a day-to-day basis. We can help you translate all of that. So that takes care of our assessment. We figure out what you have and what you need to get done to be compliant. On the build side, we document all the procedures that are needed to meet those controls so your staff know what they need to do on Monday morning to remain compliant. And then once all of the build is done and we've gone through the SOC 2 Type 1 audit, we can help you transition to operations. We can help you with that phase as well. Again, thanks for watching. So the next step if you're curious to see if engaging TRUVO Cyber is something you are interested in, you can fill out our SOC 2 readiness scorecard. It's a free scorecard that tells you where you are with your SOC 2 readiness. And then if you want to skip the line and just jump into a call, you can do that too. We provide the links both in the description. We also have a free report that we've recently published that talks about the state of the GRC market, SOC 2, and compliance in general. It's also free and ready to download. We provide a link to that as well. Thank you very much for watching, and we'll see you next time.