Vanta

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build this if you are going through an audit. What you are paying for is not the monitoring — it is that the auditor accepts the evidence.

The checks themselves are unremarkable: is disk encryption on, is two-factor required, are laptops patched, was access removed when somebody left. Any of them is a script. What takes months is agreeing with an auditor that your evidence answers their question, and that agreement is what the subscription buys.

WHEN TO KEEP PAYING
- You are actually pursuing a certification, with a date and a customer waiting for it
- Your auditor already works with it, which shortens the engagement more than any feature

WHEN NOT TO
- **You are not being audited.** A great many companies buy this in case a customer asks, and pay for years before anybody does. The honest first step is to ask sales whether the certification has ever actually blocked a deal

WHAT YOU CAN BUILD, AND SHOULD, EITHER WAY — BECAUSE IT IS GOOD PRACTICE RATHER THAN COMPLIANCE

**An offboarding checklist that is enforced.** Every account revoked, every device returned, every access removed, with a date and a person responsible. A leaver whose credentials still work three months later is the most common quiet security incident there is, and it is a table and a cron job

**An access review, quarterly.** A generated list of who has access to what, sent to whoever owns each system, requiring a reply. Half of what an audit asks for is evidence that somebody looked

**An asset inventory.** What machines exist, who has them, whether the disk is encrypted and whether they are patched. Most device management tools already answer this and nobody reads the report

**A dependency and vulnerability report** in CI, with a baseline so day one does not fail the build. That is under Snyk elsewhere in this catalogue

**And the policies, written once by a person.** Templates get you a document; what an auditor tests is whether the company does what the document says. Buying a policy you do not follow is worse than having none, because now the gap is written down

THE THING TO UNDERSTAND ABOUT THE CERTIFICATION
It says you do what you said you do. It is not a statement that you are secure. Treating the badge as the goal produces a company with excellent evidence and ordinary security, which is the failure mode this whole industry is prone to.

THE ONE-LINE VERSION
Buy it when an audit is booked. Build the offboarding checklist and the access review whatever you decide — those two are worth more than the badge.