Skip to main content

Control Implementation Details

Implementation details is a field on every control where you record how your team carries out the control, like who runs it, which tools they use, and what record it leaves. You can add details manually, draft them with the Vanta Agent or a custom agent, or update many controls at once by importing a spreadsheet. At this time, the field cannot be shared with auditors.

⚙️ User permissions: Admins, Editors, and Audit Limited Editors can manage controls. Learn more: User Permissions by Product Area

Drafting with the Vanta Agent

Ask the Vanta Agent to draft implementation details for your controls so you don’t have to write each one yourself. The agent uses information already in Vanta, like your control details, mapped tests and evidence, and approved policies. You review the drafts and approve them before the agent saves anything to your controls.

To draft implementation details with the Vanta Agent:

  1. Open the Vanta Agent.

  2. Enter a prompt that describes the controls you want to draft details for.

    • Example prompt: Add implementation details to controls I own.

    • Example prompt: Fill in implementation details for my SOC 2 controls.

  3. Review the drafts in the Approval required card.

    • The agent works in batches of up to 20 at a time.

    • The card lists each control with its drafted implementation details.

    • To add formatting like bold text, ask the agent to update the drafts.

  4. Click Approve to save the drafts to your controls.

    • If you only want to approve some of the changes, let the agent know which ones.

    • The agent confirms in the chat with a summary of the saved details.

    • Click a control ID in the summary to open the control.

    • To leave your controls unchanged, click Reject.
      ​

💡 Tip: If you already track implementation details in another control field (like a custom field or the Note field), you can migrate that content.

Example prompt: Migrate existing control documentation from the [field name] field into the implementation details field for all controls. After you check that the content copied over, you can ask the agent to clear values from the original field.

Using a custom agent

Use a custom agent to draft implementation details for your controls. Start with our agent template, which comes with the instructions already written. You can run it manually, on a recurring schedule, or on an event trigger. Each run drafts details for controls that don’t have them yet and delivers a CSV in chat. Review the drafts, then ask the agent to update your controls.

Using the agent template

With the default instructions, the agent drafts details only for controls that don’t have them yet. It skips controls that already have implementation details.

To create the custom agent from our template:

  1. Open the Vanta Agent.

  2. Select Agents > Templates > Draft Control Implementation Details.

  3. Edit the name or instructions as needed.

  4. Choose when you’d like the agent to run.

    • Manual: Run the agent yourself whenever you need it

    • Schedule: Run the agent automatically on a recurring cadence

    • Event Trigger: Run the agent automatically when an event happens

  5. Click Save—this adds the agent to your Agents page but doesn’t run it.

Running the agent

You can run the agent manually at any time, even if you set up a recurring schedule or event trigger.

To run the agent:

  1. Open the Vanta Agent.

  2. Select Agents and open the agent.

  3. Click Run now.

Reviewing the drafts

After your agent runs, you need to review the CSV with drafted implementation details and update your controls.

To review the CSV draft and update your controls:

  1. Open the Vanta Agent.

  2. Select Agents and open the agent.

  3. In the Activity section, open the completed run.

    • Review the summary in the chat.

    • It shows how many controls had no implementation details, how many the agent drafted, and anything it had to infer.

  4. Download the CSV.

    • Each row has the control ID, control name, framework codes, and drafted implementation details.

  5. In the same chat, ask the agent to update your controls.

    • Example prompt: Update the implementation details for the first 10 controls in the CSV.

    • Example prompt: Update the implementation details for controls in the CSV mapped to the HIPAA framework.

  6. Review the Approval required card, then click Approve.

    • The agent confirms in the chat with a summary of the updated controls.

    • Click a control ID in the summary to open the control.

    • To leave your controls unchanged, click Reject.
      ​

💡 Tip: You can edit the drafts in the CSV, then import it to update your controls in bulk. Learn more

Agent sources

The Vanta Agent and custom agents can use information from the following sources in Vanta to draft implementation details:

  • Controls: The name, description, and domain of each control

  • Tests: The automated tests mapped to your controls

  • Documents: The documents mapped to your controls and the evidence you provide for them

  • Evidence evaluation: The findings from evaluating the evidence on those tests and documents

  • Policies: Your approved policies

  • System description: Your system description (if applicable)

The agent relies most on the tests and documents mapped to a control. When a control has little mapped evidence, it draws more on your approved policies and system description.

Adding manually

  • Open a control from the Controls page and enter your details in the Implementation details field.

  • Enter your details in the optional Implementation details field when you create a custom control. To have Vanta AI draft, enter a description and click Generate details.

  • The Implementation details field supports rich text, like bold, italic, lists, and links. To add a link, highlight the text and paste the URL.
    ​

Bulk spreadsheet updates

Edit implementation details for many controls in a spreadsheet, then import the file to update them all at once. You can start from an export of your controls or a CSV from a custom agent.

To update implementation details in bulk:

  1. Open the Controls page.

  2. Click Add control > Via import > Use template.

  3. Click Update existing controls.

    • Click Export controls to download your controls as a CSV.

    • Or use the CSV provided to you by the custom agent.

  4. Update the Implementation Details column in your file as needed.

    • To add formatting, use markdown, like **bold**, *italic*, - for bullets, and [text](url) for links.

  5. Upload your file.

  6. Map column headers as needed.

  7. Complete the import.
    ​

💡 Tip: To move implementation details out of another control field (like a custom field or the Note field) and clear the original field in the same import:

  • Click Export controls to download all of your control fields. (Optional: save a copy of the file as a backup.)

  • Copy the values from the original field’s column into the Implementation Details column.

  • Delete the values in the original field’s column, but keep the column in the file.

  • Select Clear existing values for empty fields before you upload.

  • Upload your file and complete the import.