✅ Feature availability: Some controls features (like common controls, custom fields, and custom controls) may require an upgrade or add-on to your plan—refer to Vanta Plans and Pricing for details.
The Controls page within Vanta contains a complete list of the controls in your account. From here, you can filter, edit, and assign them, in addition to managing control mappings to frameworks, tests, document, policies, and more.
Accessing the Controls page
From the left-hand navigation panel, select Controls.
The Controls tab contains a complete list of the controls in your account, whether or not they’re currently mapped to a framework. At the top of the page, you can see a roll-up of which controls need owners, and which controls have passing evidence.
The Common controls tab is a reporting layer—controls are mapped to common controls so you can monitor your compliance program across multiple frameworks in one place.
📖 Learn more: Managing Common Controls
Searching and filtering controls
To search for a specific control, use the search bar at the top left-hand corner of the page. The results will appear in the list below.
Understanding control status
Control status provides a high-level view of whether a control’s requirements are currently being met based on its mapped tests and documents. It reflects the current state of those tests and documents—it does not represent an auditor’s assessment of the control.
Control status | Description |
Ok | All automated tests and mapped documents for the control are passing. |
Needs evidence | The control has no mapped tests or documents, or one or more mapped tests or documents are not passing. |
To move control status from Needs Evidence to OK, add a passing automated test or document. You can also view controls without mapped evidence by filtering the Evidence column on the Controls page.
⚠️ Note: Control status is not visible to auditors. If you’re using a Trust Center, control status is shared and may affect which controls are shown and how they appear there.
Editing controls
Open the control you'd like to edit.
Edit as needed and select Save Changes.
You can also map tests, documents, frameworks, and risk scenarios related to the control from here.
Modifying your controls may affect your audit—please inform your auditor of any changes as needed.
Control implementation details
Implementation details is a field on every control where you record how your team carries out the control, like who runs it, which tools they use, and what record it leaves. You can add details manually, draft them with the Vanta Agent or a custom agent, or update many controls at once by importing a spreadsheet.
📖 Learn more: Control Implementation Details
Custom fields
You can add additional fields to your controls from Compliance settings.
To manage custom control fields:
In your account header, click the Settings icon.
In the Settings page menu, scroll to the Features section and select Compliance.
Go to the Custom fields for controls section.
From here, select + Add in the top right-hand corner.
Add a label and description.
Selecting the Share with auditor option will dictate whether auditors with access to a control can see this field.
Once the data type is selected, it cannot be changed.
Click Add to save changes.
Removing controls
On the right-hand side of the control, click the three dots
Click Remove
A pop-up modal about the control and its mapped frameworks will appear.
Update the Effective date for when control deprecation went into effect
Click the Delete button
This will remove the control from the control page. Please note that Removing a Custom-Created control will permanently delete it.
Bulk deactivating controls
If you would like to deactivate multiple controls at once, select the checkbox next to the controls you would like to deactivate
Select Deactivate
Confirm that you would like to complete this action, by selecting Deactivate
Adding removed controls
Click on the More button on the top right corner of the Controls page
Select View deactivated controls
This will bring you to your deactivated controls
Find the control in the list
Click Add Control
A dialogue box will pop up
Update the Effective Date when the control went into effect
Click the Add button
Mapping controls to policies
Customization is crucial for any successful security and compliance program, and having the flexibility to add and remove controls allows you to tailor these policies to fit your needs.
Vanta policy templates already have the appropriate controls mapped to the policy, but additional controls can be added or removed as needed.
To map controls to policies:
From the Policy page, select the policy.
Select the Mapped elements tab.
Select Map control.
Search for the control, or review AI-suggested controls if available.
📖 Learn more: If you're mapping custom controls, see: Importing Custom Controls