100+ to 400+: reading integration counts for ISO 27001 evidence
By the Clause Desk · · Updated
Integration counts on the six vendors' pages run from 100+ to 400+, and one vendor publishes no count at all. For ISO 27001 evidence, five or six categories of integration do most of the work.
What do the vendors publish?
Vanta states 400+ tools, with AWS coverage of 40+ resources, Azure 30+ and GCP 25+. Secureframe states 300+ integrations. Sprinto states continuous monitoring across 300+ integrations on its pricing page. Scrut names 150+ integrations for its Evidence Collector agent, alongside AWS, GitHub and Okta. Scytale's integrations page says 100+ and its homepage says 150+; we use the lower figure. Drata describes integrations with hundreds of tools but publishes no count. On our integrations criterion, Vanta leads.
Which integrations produce most ISO 27001 evidence?
Cloud infrastructure (for configuration, logging and encryption evidence), identity and access (for MFA and access reviews), source control (for change management), HR systems (for onboarding, offboarding and training), device management (for endpoint settings and patching), and ticketing (for incidents and corrective actions). If a platform connects to your tools in those six categories, most automated evidence is covered, whatever the headline count.
What do the named integrations show?
Named lists are more useful than counts. Scytale's integrations page names GitHub, GitLab, Slack, Google Workspace, JumpCloud, Okta, Bob, Greenhouse, BambooHR, Comeet, Lever, Intercom, MongoDB, ClickUp and AWS, which covers source control, identity, HR and cloud. Its pen test workflow creates Jira tickets. Scrut names AWS, GitHub and Okta for evidence collection. Vanta breaks out its cloud coverage by resource count. Ask every vendor for the named list and check your own stack against it.
What should you ask about each integration?
Three questions. What evidence does it collect, and for which controls? How often does it run, and what happens when it fails? And does it need admin rights, which your own security team will want to review? A long list of integrations that only pull user lists is worth less than a short list that produces tested control evidence.
What about the Essential Eight?
Essential Eight evidence comes from patching, identity, device management and backup tools. If Australian customers ask about it, check those categories specifically. Vanta publishes an Essential Eight product with pre-mapped templates; for the other vendors, ask how their integrations would supply evidence for each of the eight strategies.
How much weight should integrations carry?
On our ISO 27001 weights, integrations carry 14 percent, the same as cross-mapping and pricing transparency, and less than ISMS coverage, the audit route and expert guidance. That reflects a judgement: for a first certification, a missing integration is usually a manual evidence task, while a missing audit route or missing ISMS workflow is a bigger gap. Vanta scores 9.0, Secureframe and Sprinto 8.0, Scrut 6.5, and Scytale and Drata 6.0. Companies with large, varied tool stacks may reasonably weight integrations higher in the cost estimator.
What about custom and on-prem connections?
Several vendors list options beyond the catalogue. Drata lists custom connections and tests on GRC Advanced, Secureframe lists custom integrations on Complete, Sprinto lists a custom API on Growth, and Scytale lists on-prem integrations on its Scale plan. If a key system is internal or unusual, ask which plan includes custom connections and who builds and maintains them. Custom work tends to be where timelines slip, so put it in the project plan with an owner and a date, and check that the evidence it produces maps to named ISO 27001 controls before the stage 1 audit.
What is the takeaway?
Treat the headline count as a filter, not a decision. List the six evidence categories, write down your tools in each, and ask every vendor to demonstrate the ones you run.
Filed under: Integrations, Buying