What’s the easiest way to get certified?
Is it to use something like Vanta/Drata? Are they any good?
replies(1):
Vanta/Drata are big players and they're charging big time for their platform. That's why I've started working on own startups, that's meant to disrupt this for SMBs - by making it waaay more affordable (for managing compliance, not attestation/certification itself, which we don't do).
An unsolicited suggestion: it would be helpful if you could clearly walk through how your tool supports GRC compliance. I haven’t been able to find this kind of explanation on your site—or others.
For example, something like this:
Step 1: Select a Program – Choose the compliance framework you’re targeting (e.g., ISO 27001, SOC 2, etc.).
Step 2: Guided Evidence Collection – You’re taken through a step-by-step questionnaire outlining what evidence is needed.
Step 3: Pre-Built Templates – For each requirement, you provide example templates or guidance on what needs to be submitted or completed.
Step 4: Centralized Dashboard – All responses and documents are organized into one place that can be reviewed by an auditor.
Step 5: Auditor Handoff – Once everything is ready, you recommend a third-party auditor to complete the certification process.
It would also be helpful to clarify what’s included in your offering vs. what still requires external engagement (like paying for the actual audit).
Just sharing this in case it’s helpful—apologies if I’ve misunderstood the flow above, but hopefully this illustrates the kind of clarity that might help others too.