Vanta automates evidence collection and monitors technical controls, but it does not make your organisation’s scoping and risk decisions, write policies that reflect how your business operates, implement most organisational and people controls, or provide all the judgement required for internal audits and audit preparation. A consultant or virtual Chief Information Security Officer (vCISO) can help fill those gaps.
Why This Matters
Vanta is a useful compliance platform, and understanding its limitations is not a criticism of the tool. The challenge is often a mismatch of expectations. Organisations invest in a compliance platform expecting it to deliver ISO 27001 certification, only to discover during implementation, or even during an audit, that significant parts of the standard still require work outside the platform.
ISO 27001 certification assesses a functioning Information Security Management System (ISMS), not simply a collection of automated checks. A platform can support parts of that system effectively, but people still need to make decisions, implement controls and demonstrate that the system works in practice.
Understanding this distinction early helps organisations plan their implementation more realistically and avoid unnecessary delays.
What Vanta Does Well
Vanta connects with cloud services, identity providers and other business tools through its integration library. It can collect evidence, monitor technical controls, flag configuration changes and help organise compliance activities. It also provides policy templates that can support the documentation process.
For the technical and repetitive parts of ISO 27001, these capabilities can save time and reduce manual work.
If your main challenge is the ongoing effort involved in collecting evidence and monitoring technical controls, Vanta can help address that workload. Its value comes from automating tasks that would otherwise require repeated manual effort.
The important distinction is that automating evidence collection does not automatically mean every ISO 27001 requirement has been implemented or satisfied.
What Vanta Doesn’t Do for ISO 27001
The gaps are not necessarily flaws in the platform. They are tasks that require business context, professional judgement and implementation beyond automated monitoring.
1. Define Your ISMS Scope
Your organisation needs to determine which business activities, locations, systems and processes fall within the scope of its ISMS.
These decisions depend on how your business operates, the information it handles and the boundaries of the management system. A compliance platform can support documentation, but the scope still needs to be appropriate and justified.
2. Make Risk Assessment and Treatment Decisions
Risk assessment is central to ISO 27001. Your organisation needs to identify relevant information security risks, evaluate them against defined criteria and decide how to treat them.
Vanta can support parts of the process, but your organisation remains responsible for making risk decisions that reflect its actual environment, business priorities and risk appetite.
3. Develop a Justified Statement of Applicability
The Statement of Applicability (SoA) identifies the controls selected for the ISMS, explains their inclusion and records the justification for excluding applicable controls where appropriate.
Producing a meaningful SoA requires an understanding of the organisation’s risks, control requirements and existing security arrangements. A template or automated workflow does not replace the judgement needed to justify those decisions.
4. Implement Organisational and People Controls
Not every ISO 27001 control can be addressed through a technical integration.
Organisational and people-related requirements depend on how your business operates. Examples include assigning responsibilities, delivering staff awareness activities, managing suppliers, establishing procedures and ensuring that employees follow approved processes.
These activities need to be implemented, documented and supported by evidence appropriate to the organisation.
5. Tailor Policies to Your Business
Policy templates can accelerate documentation, but they still need to reflect your organisation’s structure, systems, responsibilities and actual practices.
A policy that looks complete but describes processes nobody follows can create problems during an audit. Policies should accurately represent how security is managed and be supported by evidence that the relevant procedures operate in practice.
6. Prepare for Internal Audits and Certification
Internal auditing requires someone to evaluate whether the ISMS conforms to applicable requirements and is effectively implemented and maintained.
Audit preparation also involves reviewing evidence, identifying gaps, addressing nonconformities and ensuring that management reviews and other required activities have been completed.
A platform can help organise evidence and track activities, but it does not remove the need for competent audit judgement or responsibility for the effectiveness of the ISMS.
Why the Gap Causes Problems
Problems arise when organisations discover these limitations late in the implementation process.
A team may rely heavily on its compliance platform, only to find that the risk assessment lacks sufficient depth, the Statement of Applicability is poorly justified, policies do not reflect actual practices, or organisational controls lack supporting evidence.
The platform’s dashboard may show that monitored technical controls are operating as expected, while other parts of the ISMS remain incomplete.
This distinction matters because an ISO 27001 auditor assesses the management system, not simply the compliance platform.
Automated evidence can be valuable, but it cannot compensate for missing risk decisions, ineffective processes or controls that exist only on paper.
Who Fills the Gap?
A consultant or virtual CISO can provide the expertise needed to address work that extends beyond platform automation.
Depending on the engagement, this support may include:
Defining and documenting the ISMS scope.
Facilitating risk assessment and treatment decisions.
Developing and maintaining the Statement of Applicability.
Tailoring policies and procedures to the organisation.
Supporting implementation of organisational and people controls.
Coordinating evidence collection and remediation.
Preparing the ISMS for internal and external audits.
The consultant or vCISO works alongside your team and compliance platform, helping ensure that the system reflects your actual business and security requirements.
For organisations without a dedicated security or GRC team, this support can provide experienced guidance without necessarily requiring a full-time internal hire.
Using Vanta and Expert Support Together
For many organisations, the most practical approach is to combine automation with experienced guidance.
Vanta can help manage repetitive evidence collection and technical control monitoring. A consultant or virtual CISO can address the decisions, organisational controls and implementation work that require business context and professional judgement.
This division of responsibilities allows your team to retain the efficiency of automation while addressing the wider requirements of ISO 27001.
The objective is not to replace your compliance platform. It is to use it for the tasks it handles effectively while ensuring that the underlying ISMS is complete, appropriate and operating as intended.
Get Expert Support for Your ISO 27001 Implementation
If your organisation is using Vanta but needs help with risk decisions, ISMS implementation or audit preparation, Intrix’s virtual CISO services can provide experienced security leadership and guidance throughout the certification process.
Our cyber security risk assessment services can also help your organisation identify, evaluate and prioritise information security risks.
For further information, visit the official ISO/IEC 27001 standard page and Vanta’s website.
Frequently Asked Questions
What Does Vanta Not Do for ISO 27001?
Vanta can automate evidence collection and monitor technical controls, but organisations still need to make appropriate scoping and risk decisions, justify their Statement of Applicability, implement organisational and people controls, tailor policies and prepare for audits.
Why Can Relying on Vanta Alone Cause Problems?
ISO 27001 certification assesses the effectiveness of the ISMS as a whole. Automated checks and evidence collection do not guarantee that risk assessments, policies, organisational controls and required management activities are complete or effective.
Who Fills the Gap Vanta Leaves?
A consultant or virtual CISO can support ISMS scoping, risk assessment, control implementation, policy development, evidence management and audit preparation. The scope of support depends on the organisation’s needs and existing capabilities.
Should I Use Vanta and a Consultant Together?
For many organisations, combining the two is a practical approach. Vanta helps automate evidence collection and technical monitoring, while a consultant or vCISO provides guidance on risk decisions, organisational controls and the wider ISMS. The combination can reduce manual work while addressing requirements that automation alone does not fulfil.
