Skip to main content

Importing Custom Controls

✅ Feature availability: You can create custom controls on any current plan. Some controls features may require an upgrade or add-on to your plan—refer to Vanta Plans and Pricing for details. Importing custom controls with the Vanta Agent is a new feature being gradually rolled out in place of the bulk uploading experience—you can contact your Customer Success Manager to request access if you don’t see it in your account.

While Vanta offers a comprehensive set of prebuilt controls mapped to frameworks like SOC 2, ISO 27001, and HIPAA, your company might have unique workflows, tools, or regulatory obligations that require more tailored controls. Custom controls let you document security and compliance requirements that aren’t covered by one of Vanta's default controls, whether you already have them defined or you're creating them from scratch. When you add a custom control, you’ll need to review and add the right framework, test, and evidence mappings so you can track it as part of your program. You can add custom controls with the Vanta Agent, in bulk, or one at a time.

⚙️ User permissions: Admins, Editors, and Audit Limited Editors can manage custom controls. Learn more: User Permissions by Product Area

Importing custom controls with the Vanta Agent

If you have an existing compliance program to bring into Vanta, ask the Vanta Agent to help import your controls. Upload your files, and the agent reviews each one, creates custom controls, and suggests relevant evidence mappings (like tests and documents) for you to review—all in the same guided conversation.

To import your controls with the Vanta Agent:

  1. Open the Vanta Agent.

  2. Ask the agent to help import your policies. For example: “Help me import my custom controls.”

  3. Upload your control files:

    • You can upload up to 30 files at once, with a 50 MB total limit per upload.

    • When uploading controls, CSV, XLS, or XLSX files work best, up to 10 MB each.

    • The agent classifies each file and asks you to confirm before continuing.

  4. Review the control details for each control being imported, then confirm when you’re ready to create the custom controls:

    • The agent extracts control details for you to review in a user-friendly table view.

    • You can chat with the agent to update control details like the ID, name, description, domain, owner, and framework mappings before the controls are created.

    • The agent can only create new custom controls—it can’t update existing custom policies already added to Vanta.

  5. Review the suggested mappings, then accept or reject the suggestions.
    ​

💡 Tip: You can upload custom policies and custom controls in the same Vanta Agent conversation. The agent will classify the files, import the policies and controls through the same guided flow, and suggest mappings between them for you to review. Just ask: “Help me import my compliance program.”

Bulk uploading custom controls

If you have several existing controls to bring in at once, you can upload a CSV or Excel file from the Controls page. You can create new controls or update existing ones, and map your file's columns to Vanta's fields.

To upload your controls in bulk:

  1. From the Controls page, click Add control and select Via import (.csv, .xlsx).

  2. Choose Create new controls or Update existing controls.

  3. Download the CSV template to use as a starting point.

    • ID and Description are the only required fields.

  4. Upload your file.

  5. Map your file's columns to Vanta's fields.

  6. Review and fix any flagged rows.

  7. Finish the import to create or update the controls.
    ​

Creating a custom control

If you're documenting a requirement from scratch, or only have one custom control to add, create a custom control directly from the Controls page.

To add a custom control manually:

  1. From the Controls page, click Add control and select Add custom control.

  2. In the New control modal, fill in the control details:

    • Required: Description, Domain, Control ID, Effective date

    • Optional: Control name, Framework code

  3. Select Add control.
    ​

ℹ️ Note: Vanta sets the Effective date to today by default, but you can change it if needed. If the Control name is left blank, Vanta uses the Control ID as the name.

Managing custom controls

After you create a custom control, it’s added to the Controls page. You can assign Control Owners, manage control mappings, and edit control details at any time.

💡 Tip: You can also use the Vanta Agent to manage your custom controls, which helps reduce the effort it takes to make bulk changes. The Vanta Agent can help you assign owners, as well as map tests, documents, and create custom frameworks.

Assigning owners

To assign owners to controls:

  1. From the Controls page, click directly into the Owner column for the control.

  2. Search for and select the person or team you want to assign.

Mapping tests

To map controls to tests:

  1. From the Controls page, open the control.

  2. In the Mapped elements tab, scroll to Tests.

  3. Select the + button to add a test, or use the remove action to remove an existing one.

  4. Search the full list of tests, or turn on Suggest by Vanta AI to review AI-suggested tests.

  5. Select the test you want to link, then click Add.

Mapping documents

To map controls to documents:

  1. From the Controls page, open the control.

  2. In the Mapped elements tab, scroll to Documents.

  3. Select the + button to add a document, or use the remove action to remove an existing one.

  4. Search the full list of documents, or turn on Suggest by Vanta AI to review AI-suggested documents.

  5. Select the document you want to link, then click Add. You can also upload a new document by selecting New document.

Mapping policies

Controls can be mapped to policies to show which policies support or document the control.

To map controls to policies:

  1. From the Policies page, select the policy.

  2. Click the Mapped elements tab.

  3. Click Map control.

  4. Search for the control, or review AI-suggested controls if available.

  5. Select the control you want to link, then click Add.

Mapping frameworks

The same control can be mapped to multiple frameworks and requirements.

To map controls to frameworks:

  1. From the Controls page, open the control.

  2. In the Mapped elements tab, scroll to Frameworks.

  3. Select the + button to add a framework mapping, or use the remove action to remove an existing one.

  4. Select the framework using the dropdown, then use the search bar to find the requirement by code, name, or description.

  5. Select the appropriate requirement, then click Add.

Mapping risk scenarios

To map controls to risk scenarios:

  1. From the Controls page, open the control.

  2. In the Mapped elements tab, scroll to Risk scenarios.

  3. Select the + button to add a risk scenario, or use the remove action to remove an existing one.

  4. Search the full list of risk scenarios.

  5. Select the risk you want to link to, then click Add.

Linked issues

Issues linked to a control appear in the control’s Mapped elements tab, helping you see related gaps, remediation work, or audit findings. To link a control to an issue, open the issue and add the control from the issue’s mapped elements area.

Deactivating or deleting custom controls

⚠️ Note: Deactivating and deleting are different actions. Deactivating a control removes it from your security program and removes its framework and monitor mappings, but a deactivated control can be restored later. Deleting a custom control permanently removes it from your program and related frameworks, and this action can't be undone.

  • To deactivate: Open the control > click the ••• menu and select Deactivate > click Deactivate.

  • To delete: Open the control > click the ••• menu and select Delete > click Delete.