ISO 27001 Templates vs Vanta, Drata and ISMS.online: 6 ISMS Decisions No Platform Makes for You, and Which Option Fits Your Budget

A compliance platform such as Vanta, Drata or ISMS.online automates the collection of evidence. ISO 27001 templates give you the documents. Neither one makes the decisions that ISO/IEC 27001:2022 assigns to your organisation, its top management and its risk owners: where the ISMS boundary sits, how much risk is acceptable, which Annex A controls apply, whether residual risk is accepted, what the objectives are, and what changes after a management review. Whichever you buy, those six decisions stay with you. The real question is whether you need software to prove them continuously, or documents to record them well.

A note on where we stand: we sell an ISO 27001 template toolkit, so we have an interest in one side of this comparison. That is why every vendor claim below is taken from the vendor’s own pages or from named buyer data, and quoted where it appears in quotation marks, and why the section on when a platform is the better buy is as specific as the section on templates.

What each option actually buys

In plain terms: templates are a one-off purchase of documents you adapt. A platform is an annual subscription that connects to your systems, runs tests against them and stores the evidence. The certification audit is a separate cost either way.

What you need for certification	Template toolkit	Compliance platform (Vanta, Drata, ISMS.online)
Mandatory ISMS documents (scope, policy, risk method, SoA, objectives)	Supplied as editable Word and Excel files	Policy templates included; Vanta’s pricing page lists a pre-built policy template library, Drata’s lists policy templates
Evidence that technical controls run	Collected by hand (screenshots, exports, logs)	Pulled through integrations; Vanta says it “runs hourly control tests”
Statement of Applicability	Pre-built table you complete	Vanta says it “auto-generates” the SoA mapping; Drata offers an SoA template or takes your upload
Internal audit and management review	Checklists and minutes templates	Workflows to assign, track and store them; the records are still yours to produce
Price model	One-off (ours: €397, introductory price)	Annual, quote-based; none of the three publishes list prices
Certification audit fee	Paid separately	Paid separately

The biggest difference in the table is the second row. Templates leave evidence collection to you; a platform automates it for the controls its integrations can see. Everything else on the list, the decisions in particular, is work you do on either route.

The 6 ISMS decisions no platform makes for you

Each of these decisions comes from a clause in ISO/IEC 27001:2022, and each one names who must make it: the organisation, top management or the risk owners. A platform can hand you a template, a default workflow or an approval button. It cannot sign. The table follows the clause explainers published by the consultancy Tranquility Cybersecurity (TCSA), whose pages state that they are written by certified lead auditors; the standard itself is paywalled.

Decision	Clause	What a platform supplies	What only your organisation can do
1. Where the ISMS boundary sits	4.3	An asset and system inventory from integrations; a scope template	Decide which units, services, locations and suppliers are inside, and document the interfaces
2. How much risk is acceptable	6.1.2	A risk register and scoring workflow	Set the risk acceptance criteria and name a risk owner for each risk
3. Which Annex A controls apply, and why	6.1.3	An SoA template or, on Vanta, a generated mapping to tests and documents	Write the justification for each control you include and each one you exclude
4. Whether residual risk is accepted	6.1.3	An approval workflow (Vanta’s pricing page lists “Multiple risk approvers”)	Risk owners approve the treatment plan and accept the residual risk
5. What the ISMS must achieve	6.2	Fields to record objectives and owners	Set objectives that match the policy and plan who delivers them, with what and by when
6. What changes after review	9.3	A place to store the minutes	Top management decides on improvements and any needed changes to the ISMS

The clearest evidence comes from the platforms themselves. Drata’s help centre publishes a list of ISO 27001 controls that are “not automatically monitored in Drata“. It runs to more than 140 rows, last updated 1 July 2026. Four of the six decisions appear on it as named evidence you upload yourself: the management system scope (DCF-161, “your ISMS Plan showing the defined scope”), the Statement of Applicability (DCF-162), the management system objectives (DCF-170) and the most recent management review (DCF-164). The other two, risk acceptance and residual-risk approval, are not named separately; the closest items are the risk assessment and the risk treatment plan (DCF-16, DCF-17), which are on the list as well.

Vanta’s documentation points the same way. Its ISO 27001 product page says it “auto-generates your Statement of Applicability mapping each control to real tests and documents”. Its own help article on the SoA still asks you to set each control’s status (implemented, excluded, in-process or not started) and to start with the “Justification for Control Inclusion” column. The mapping is generated; the reasoning is yours.

This matters at the audit. A certification auditor reviews your documentation at Stage 1. At Stage 2, according to consultancy Bridewell, they interview managers and staff and look for evidence that you follow that documentation, including your internal audits and management reviews. A manager who cannot explain why a control was excluded is a problem no dashboard can fix.

What Vanta, Drata and ISMS.online automate well

Platforms are strongest where controls leave machine-readable traces: identity, devices, cloud configuration, code. Vanta says it connects to “400+ tools” on its pricing page and that “most teams certify in 12–24 weeks” on its ISO 27001 page. Those are the vendor’s own figures, not independent measurements, but the mechanism is real. A test that checks every hour whether MFA is enforced or a laptop is encrypted produces better evidence than a screenshot taken the week before the audit.

The limit is in the structure of Annex A. Annex A of ISO 27001:2022 lists 93 controls, the same set that ISO/IEC 27002:2022 describes in four themes, as the Cloud Security Alliance summarises. ISMS.online’s ISO 27001 guide gives the split: 37 organisational, 8 people, 14 physical and 34 technological. Integrations mainly reach the technological theme (our reading of how they work, not a vendor statement). For physical controls, Drata’s own list asks for photos, or for the auditor to observe a visitor being escorted, a badge being issued, or the fire suppression and UPS systems. Most of the organisational theme is policy, supplier and process work that people carry out and evidence.

The three platforms differ in emphasis:

• Vanta leads with integrations and automated tests. Its entry tier, Essentials, includes “one compliance framework with agentic policy generator”.
• Drata is similar in approach. Its pricing page (drata.com/pricing) shows that the Compliance Foundation plan includes one pre-mapped framework, “limited to SOC 2, ISO 27001, Cyber Essentials, HIPAA, and GDPR”.
• ISMS.online is built more as a structured ISMS workspace. Its plans page highlights pre-configured templates, a guided certification path using its ARM method, and a choice of over 100 frameworks.

Templates have the opposite weakness. Advisera, which sells a product that blends templates and software, says templates are “difficult to use for activities where continuous changes are needed”, such as risk management, incidents and internal audits. That matches what we see: the documents are easy to write, but a living risk register kept in a spreadsheet needs someone who owns it.

What each option costs over three years

None of the three vendors publishes a price. Vanta’s pricing page asks you to request a demo “to discuss your business needs and get personalized pricing”. ISMS.online says its “pricing is bespoke to you”. Drata’s page lists plans without amounts. The best public data comes from the procurement platform Vendr, which reports what buyers paid for each product:

Option	Reported annual price	Three years at that price	Basis
Vanta	Median $20,000 (range $7,500 to $57,192)	About $60,000	Vendr, 375 purchases, updated February 2026
Drata	Median $24,934 (range $9,415 to $68,250)	About $74,800	Vendr, 236 purchases, updated February 2026
ISMS.online	Quote only	Not publicly reported	Vendor plans page
Template toolkit (ours)	€397 one-off (introductory; rises to €497)	€397, plus your team’s time	Our product page

Read the table with these caveats in mind. Vendr reports overall medians for each product, not a price for ISO 27001 alone, and in dollars (Vendr shows a $ sign), while our price is in euros. For ISMS.online, budget fit can only be judged from a quote. The three-year figures are our own arithmetic and assume a flat price. And the template figure leaves out the hours your team spends collecting evidence by hand. The certification body’s audit fees come on top of either route; our ISO 27001 certification cost breakdown covers them by phase.

Which option fits your situation

The useful test is not which tool is better, but where your controls live and how many frameworks you have to prove.

Your situation	Better fit	Why
Cloud SaaS company, most controls in AWS, Azure or GCP, identity provider and endpoint tools	Platform	Integrations can watch much of the technological theme continuously
Need SOC 2 and ISO 27001, or a steady flow of customer security questionnaires	Platform	Controls linked to several frameworks (ISMS.online calls this “mapping & linking”); Vanta’s Plus tier includes questionnaire automation
Manufacturer, on-premise IT or a mostly physical scope	Templates	More of the evidence is observation, records and procedure, which no integration reads
First certification, one framework, tight budget	Templates	The six decisions and the mandatory documents are the critical path, and a platform does not take them off your hands
Consultant-led project	Templates	The consultant supplies the method; you need documents you own and can edit

Different readers should look at different rows:

• CISO or IT security lead: list your Annex A controls by theme before any demo, and ask each vendor which ones its integrations monitor for your actual stack.
• SME owner: compare the platform’s annual fee with the internal hours it saves. If most of your controls are physical or procedural, it saves fewer of them.
• Compliance officer: make sure the policy, SoA and evidence can be exported in editable formats. You will need them if you change tools or certification bodies.
• Board or managing director: clauses 9.3 and 6.1.3 put the review and the residual-risk acceptance on management and the risk owners. Budget for that time whichever tool you buy.

Many organisations do both, in sequence: they write the decision documents first, from templates, then add a platform once the scope and the frameworks justify the subscription. Vanta and Drata both accept that order. Vanta lets you “upload your version” of the SoA, and Drata asks you to upload one unless you manage it in its Policy Center. For the full path from gap analysis to Stage 2, see our ISO 27001 compliance guide. If NIS2 also applies to you, our comparison of 10 GRC tools for NIS2 scores Vanta and Drata on six NIS2-specific criteria, including Article 21 evidence.

Frequently asked questions

Can Vanta or Drata get you ISO 27001 certified without templates?

Both include policy templates, so you do not need a separate toolkit to have documents. What you still need is the content those documents record: your scope, risk acceptance criteria, SoA justifications, residual-risk sign-off, objectives and management review decisions. Certification is granted by an independent certification body after its audit, not by the platform.

Are templates enough for ISO 27001 certification?

Templates can cover the mandatory documents, but certification also needs evidence that the ISMS operates: completed risk assessments, an internal audit, a management review and records from running the controls. On a template route, your team collects that evidence by hand.

Can you move from templates to a platform later?

Yes, with Vanta and Drata at least; check ISMS.online’s import options before you buy. Vanta lets you upload your own Statement of Applicability, and Drata asks you to upload your SoA if you do not manage it in its Policy Center. Documents you wrote from templates can move across, as long as they are in editable formats.

Does a compliance platform replace the internal audit?

No. Vanta offers internal audit workflows to assign internal auditors, track reviews and centralise findings, and Drata still lists internal audits as evidence you upload (DCF-165). The audit itself, and the management review that follows it, are activities your organisation carries out.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

1. Tranquility Cybersecurity (TCSA). ISO 27001:2022 clause explainers: 4.3 Determining the scope of the ISMS, 6.2 Information security objectives and planning, 9.3 Management review; 6.1 Actions to address risks and opportunities (linked above).
2. Drata Help Center. Example Evidence for Not Monitored Controls (ISO 27001), revised following 5/7/2024 updates, updated 1 July 2026 (linked above).
3. Vanta. ISO 27001 compliance automation software, product page and FAQ (linked above).
4. Vanta Help Center. Getting Started with ISMS 11: Statement of Applicability (linked above).
5. Vanta. Plans and Pricing (linked above).
6. Drata. Pricing, drata.com/pricing, checked 26 October 2026.
7. ISMS.online. IO Plans (linked above).
8. Vendr. Vanta and Drata software pricing, buyer data updated February 2026 (linked above).
9. ISMS.online. ISO 27001 guide, control groups of ISO 27001:2022 (linked above).
10. Cloud Security Alliance. ISO/IEC 27002:2022: Understanding the Update (linked above).
11. Advisera, Rhand Leal. Using ISO 27001 online software vs. documentation templates (linked above).
12. Bridewell. What to expect from Stage 1 and Stage 2 ISO 27001 certification audits (linked above).