Audit and compliance
Policies, controls and evidence, ready before the auditor asks.
Every policy has an owner and a cadence, every control has a status and a score, and every evidence file has a reviewer. Your expert team runs the audit program, and an independent auditor performs the audit.
Audit readiness
Example- Policies
- Most approved, a few in review
- Controls
- Mostly implemented, a handful partial
- Evidence documents
- Most accepted, four need attention
Your cyber expert decides which open documents block the audit and which can wait.
What the platform holds
Four records, each with an owner and a status.
This is what you and your auditor will actually open.
Policies
Policies start from templates, tailored by your cyber expert. Each has a named owner, reviewer and approver and a review cadence.
Controls
Controls come from your assessments rather than data entry. Each has an owner, an implementation status, a justification and a score, and missing owners are flagged.
Evidence documents
Create a document from a standard definition, attach the file, and track it from draft through review to accepted or rejected.
Notes and history
Every record keeps notes and a timeline of who changed what and when, so you can answer an auditor without reconstructing it.
How a cycle runs
From assessment to audit, in the order it happens.
Show the steps of a cycle
- 1
Platform
Your assessment fills the control list
Completing a risk assessment against a framework creates your controls with a starting score. Every control traces back to an assessment.
- 2
You and your cyber expert
Policies start from templates, tailored by your cyber expert
You choose a template, your cyber expert tailors it with you, and each policy is linked to the controls it supports, with an owner and a review cadence.
- 3
You and VectraIQ
Evidence is uploaded and checked
Files are stored privately. VectraIQ reads each one against what that type of document should contain and flags what is missing.
- 4
Your cyber expert
Gaps are reviewed and closed
Your cyber expert goes through the gaps with you, assigns the fix, and accepts the document when it holds up.
- 5
Your cyber expert
The audit program is tracked end to end
Your expert team tracks the program with you, from readiness through the auditor’s requests. An independent auditor performs the audit; Vectra View does not issue any certification.
Worked example
One access review, from upload to Accepted.
Your IT lead uploads the quarterly access review export. It is stored privately and VectraIQ reads it against what an access review should contain.
The result lists each requirement and whether the document meets it. Two need work: the review date is outside the audit period, and removed accounts show no revocation date.
Your cyber expert reads both with the owner, agrees the fix, and asks for a corrected export. When it holds up, the document is accepted and your readiness numbers move with it.
Quarterly access review
Example- Review covers every in-scope systemMet
- Reviewer and approver namedMet
- Review date falls inside the audit periodNot met
- Removed accounts show a revocation dateNot found
Two lines to resolve before this is accepted. VectraIQ reads the file; your cyber expert decides whether the evidence is enough.
Who does what
Your team owns the facts. VectraIQ reads. Your cyber expert signs off.
Your team
Name policy, control and document owners; Upload the evidence only your team holds.
VectraIQ
Reads an uploaded file and writes a quality score and summary; Checks it against what that document should contain.
Your expert team
Reviews the document checks before a document is accepted; Decides what is ready to hand to the auditor.
The independent auditor is a fourth party: they perform the audit, and we do not issue certifications. Read what readiness involves for each framework and how the managed program works.
What you get
Outputs you can hand to someone else.
Exports
Your controls and your evidence documents export to CSV, filtered the way you are viewing them.
Policy documents
Each policy carries its version and effective date, and the attached document can be downloaded.
Readiness numbers
Compliance status, framework scores and controls at risk are on the dashboards. See reporting and dashboards.
Controls and policies connect to the rest of the platform: frameworks and controls explains the mapping, and reporting and dashboards shows the same numbers over time. Evidence files are covered by the access and storage rules on our security page.
Questions, answered.
Where do our controls come from?
Your assessments create them, so every control traces back to an assessment and starts with a score. You then set the owner, implementation status and justification on each one.
Who can change a policy?
Only the people named as a policy’s owners can change it. Everyone else with access can read it.
What happens to a file I upload as evidence?
The platform accepts only the file formats allowed for that document type, scans the file, and stores it privately for signed-in users of your account.
Will Vectra View certify us?
No. We get you ready and manage your audit program; an independent auditor performs the audit and issues any report. Naming a framework on our site does not mean we hold it.
More in the platform
Explore the rest of the platform.
- Risk assessmentsRun a risk assessment, score it, and turn the findings into issues and risks.
- Third-party riskAssess vendors, tier them by criticality and keep watching them between reviews.
- Risk managementA risk register with owners, treatment and progress, rolled up into dashboards.
- Frameworks and controlsOne control library mapped across the frameworks you report against.
- Reporting and dashboardsExecutive dashboards and board reports drafted for your cyber expert to finalize.
- VectraIQThe AI inside the platform: ask where you stand, get insights, draft reports.
Get your evidence in order before the auditor asks.
Tell us which audit is coming and a lead expert will map what you need and by when.