Compliance Automation and GRC

Vanta · vanta:product-scope

Vanta SOC 2 product automates compliance with continuous monitoring, automated evidence collection from cloud and identity integrations, policy management, and auditor network access for audit readiness.

Source (official, accessed 2026-08-09): https://www.vanta.com/products/soc-2

• Homepage also lists risk, TPRM, Trust Center, and questionnaire automation; SKU scope depends on purchased plan.

Vanta · vanta:pricing-transparency

Vanta pricing page publishes Essentials, Plus, Professional, and Enterprise plan tiers with feature comparisons but directs buyers to request personalized pricing or a demo; no public dollar list prices on the page reviewed.

Source (official, accessed 2026-08-09): https://www.vanta.com/pricing

• Quote-only status confirmed; actual contract pricing requires sales engagement.

Vanta · vanta:admin-identity

Vanta pricing comparison lists SSO and pre-built role-based access controls on Essentials tier; SCIM and custom RBAC are add-ons on Plus, Professional, and Enterprise tiers.

Source (official, accessed 2026-08-09): https://www.vanta.com/pricing

• Feature availability varies by plan tier; verify SCIM entitlement before procurement.

Vanta · vanta:admin-identity

Vanta security page notes Okta for workforce identity with WebAuthn MFA.

Source (official, accessed 2026-08-09): https://www.vanta.com/security

• Workforce identity details describe Vanta's own operations; customer SSO/RBAC entitlements are on the pricing page.

Drata · drata:product-scope

Drata Help Center Quick Start describes a compliance automation platform that connects identity, infrastructure, version control, and ticketing systems to automate monitoring and evidence collection, establish continuous compliance for frameworks, prepare personnel and policies, and support auditor workflows.

Source (official, accessed 2026-08-09): https://help.drata.com/en/articles/13265650-quick-start-guide

• Marketing product pages are now additionally accessible; Help Center remains a valid official scope source.
• SecurityChecklist has not independently tested Drata.

Drata · drata:pricing-transparency

Drata plans page publishes Foundation, Advanced, and Enterprise packaging for GRC Platform and Assurance Platform with feature matrices and CTAs for Get Personalized Pricing / Get Started / Contact Sales rather than a public dollar rate card; treated as quote-only as of this check.

Source (official, accessed 2026-08-09): https://drata.com/plans

• No public USD list prices on the page reviewed; contract pricing requires sales engagement.
• Feature packaging can change; re-check before publication.

Drata · drata:security-architecture

Drata security page states data is encrypted at rest and in transit using known strong protocols and ciphers; authentication uses 2FA with phishing-resistant hardware / WebAuthn MFA; hosting is on AWS and GCP; controls include WAF, CSP headers, DDoS mitigation, Infrastructure as Code with vulnerability and Compliance as Code scans, anomaly detection (including GuardDuty and Google Security Center), CSPM, MDM-managed endpoints with EDR, and Zero Trust network/access design.

Source (official, accessed 2026-08-09): https://drata.com/security

• Architecture claims are vendor-stated; SecurityChecklist has not independently verified encryption cipher suites or control effectiveness.

Drata · drata:independent-or-standards

Drata security page states Drata uses independent experts to verify security, privacy, and compliance controls and has achieved certification and attestations against stringent standards, directing reviewers to the Trust Center; the Trust Center publicly features SOC 2 Type 2 compliance documentation and an External Penetration Test Report among featured documents.

Source (official, accessed 2026-08-09): https://drata.com/security

• Certification claims are vendor-stated; full reports on trust.drata.com may require Get access / NDA and were intermittently HTTP 403 from some clients during this recheck.
• SecurityChecklist has not independently verified certificates or pen-test reports.

Drata · drata:independent-or-standards

Drata Trust Center (SafeBase) publicly lists featured Compliance document SOC 2 Type 2 and Reports document External Penetration Test Report, alongside Product Security artifacts such as CAIQ and Data Flow Diagram.

Source (official, accessed 2026-08-09): https://trust.drata.com/

• Detailed document download may require access request; some automated clients received HTTP 403 while a browser-class fetch retrieved the public Trust Center summary.
• FedRAMP Class B / 20x pilot wording on the Trust Center was not treated as a full ATO claim in this pack.

Secureframe · secureframe:product-scope

Secureframe packages page describes compliance automation with infrastructure monitoring, evidence collection, personnel/policy/risk management, Trust Center, questionnaire automation, third-party risk management, and Defense/CMMC tooling (SSP, POA&M, SPRS) across Fundamentals, Complete, and Defense packages.

Source (official, accessed 2026-08-09): https://secureframe.com/pricing

• Feature sets differ by package; SecurityChecklist has not independently tested Secureframe.

Secureframe · secureframe:admin-identity

Secureframe Complete package lists SSO & SCIM Connections; security page also states user access controls with single sign-on and role-based account access workflows.

Source (official, accessed 2026-08-09): https://secureframe.com/pricing

• SSO/SCIM appear tied to Complete (and above); confirm entitlement and IdP matrix before procurement.