Public facts, each with its source and read date.
StandardOS, compared
- Who it applies to
- Anyone weighing StandardOS against Vanta, Drata, Secureframe or Cyberday, on facts each of them publishes rather than on our opinion of them.
- The dates
- Every cell carries the day the other side's page was read, and a page says which day at the top.
- The one thing to do
- Open the comparison for the platform you are actually considering: one card, one table, and a fact the other side does not publish written as not published, never estimated.
€249/mo excl. VAT, flat per organization, every feature, unlimited people. Each page below is one card and one table; a fact the other side does not publish is written as not published, never estimated.
By their own pages
StandardOS vs Vanta
4 of 8 capabilities only on our side, by their own pages
- Yes1
- Not offered4
- Not stated3
StandardOS vs Drata
4 of 8 capabilities only on our side, by their own pages
- Yes0
- Not offered4
- Not stated4
StandardOS vs Cyberday
1 of 8 capabilities only on our side, by their own pages
- Yes0
- Not offered1
- Not stated7
StandardOS vs Secureframe
4 of 8 capabilities only on our side, by their own pages
- Yes0
- Not offered4
- Not stated4
What only StandardOS does, checked against their pages
Eight things, each read on the four platforms' own pages on 24 September 2026: where a platform has it, its cell says so in the platform's words; where its pages say nothing, the cell says so and names the page.
The regulations' paperwork
CRA technical fileCRA technical file generated from the product recordStandardOS:YesAnnex VII file, eleven documents, from the recordVanta:Not offeredCRA not on its frameworks pageDrata:Not offeredCRA not among its frameworksCyberday:Not statedArticle 13 as tasks; the file not mentionedSecureframe:Not offeredCRA not on its frameworks page
What we do
Yes: the Annex VII file, eleven documents, written from the product's record and kept as it changes; on the site as a writer, in the product as the file.
our pageWhat Vanta's page says
Not offered: the Cyber Resilience Act is not among the frameworks on its frameworks page (ISO 27001, ISO 42001, NIS 2, DORA, the EU AI Act and others are).
Source, read 24 Sep 2026What Drata's page says
Not offered: not among the "30+ Pre-Built Frameworks" on its frameworks page (NIS 2, DORA and GDPR are).
Source, read 24 Sep 2026What Cyberday's page says
A CRA framework page: the Article 13 requirements mapped to tasks. Nothing on the page about the technical documentation or Annex VII.
Source, read 24 Sep 2026What Secureframe's page says
Not offered: the Cyber Resilience Act is not on its frameworks page (GDPR, EU DORA and NIS2 are).
Source, read 24 Sep 2026Reporting clocksCRA, NIS2, DORA and GDPR reporting clocks, with the notification draftedStandardOS:Yes24h, 72h and final clocks, notice draftedVanta:Not statedIncident logging; no clock on its pagesDrata:Not statedReporting named; no clock on its pagesCyberday:Not statedIncident log; no clock on its pagesSecureframe:Not statedOne line each on NIS2 and DORA
What we do
Yes: the 24-hour, 72-hour and final-report clocks from the moment you became aware, the NIS2 and GDPR clocks on their own pages, and the notification drafted in the product from the record it already holds.
our pageWhat Vanta's page says
Logging, not clocks: "Log incidents, map them to DORA requirements, and prepare for advanced resilience testing so you're always ready to report and respond." No deadline and no drafted notification on the DORA or NIS 2 pages.
Source, read 24 Sep 2026What Drata's page says
"Improve incident response and reporting" and "stay prepared for supervisory reviews and incident reporting obligations" on the NIS 2 page; no clock and no drafted notification on the pages read.
Source, read 24 Sep 2026What Cyberday's page says
"Incident management: Define the handling process and log incidents with clear responsibilities." No clock and no drafted notification on the pages read.
Source, read 24 Sep 2026What Secureframe's page says
NIS2 and EU DORA are listed as frameworks with one sentence each; nothing about reporting clocks or notifications on the pages read.
Source, read 24 Sep 2026DORA register of informationDORA register of information generated from the contractsStandardOS:YesRegister rows from your ICT contractsVanta:YesFrom a vendor inventory, with templatesDrata:Not statedDORA oversight; register not mentionedCyberday:Not statedDORA text as tasks; register not mentionedSecureframe:Not statedOne line on DORA; register not mentioned
What we do
Yes: in the product the ICT service contracts you hold are the register's rows, each with the data sheet of Implementing Regulation (EU) 2024/2956; on the site the vendor's own rows are written from its answers.
our pageWhat Vanta's page says
Yes, from a vendor inventory with templates: "Vanta discovers shadow IT via IdP/SSO and device signals, inventories vendors, and helps you populate the Register of Information using ESA-aligned templates."
Source, read 24 Sep 2026What Drata's page says
"Drata extends DORA controls to critical ICT service providers, helping teams track oversight, evidence, and ownership for third-party dependencies." The register of information is not mentioned on the page.
Source, read 24 Sep 2026What Cyberday's page says
The DORA page maps the Regulation's text to tasks; the register of information is not mentioned on it.
Source, read 24 Sep 2026What Secureframe's page says
EU DORA is listed as a framework with one sentence; nothing about the register of information on the pages read.
Source, read 24 Sep 2026Records you can check
Hash-chained recordsHash-chained records with a published verifierStandardOS:YesHash chain, verifiable without usVanta:Not statedNot stated on its security pageDrata:Not statedNot stated on its automation pageCyberday:Not statedAudit log; no hash chain statedSecureframe:Not statedNot stated on its product page
What we do
Yes: every record carries the hash of the one before it, the export carries the chain, and a published script recomputes it without us.
our pageWhat Cyberday's page says
An audit log: "Comprehensive item-based audit logging: Track all changes on items" and "Task audit log: Automatically track all task activity". No hash chain and no verifier a customer can run on the pages read.
Source, read 24 Sep 2026Spreadsheet importImport from spreadsheets, every row confirmed by its ownerStandardOS:YesImport, every row confirmed by its ownerVanta:Not statedSpreadsheets as the problem; no importDrata:Not statedReplaces spreadsheets; no import describedCyberday:Not statedBulk add, Excel export; no importSecureframe:Not statedNot described on its product page
What we do
Yes: drop the Statement of Applicability, the risk register and the policies you keep; every row is staged, a person ticks what is written, and the rest is built.
our pageWhat Vanta's page says
Spreadsheets appear as the problem a customer had, in that customer’s words: "Things were kept in spreadsheets and in people’s heads, making it very difficult to juggle multiple large-scale compliance audits." An import is not described on the pages read.
Source, read 24 Sep 2026What Drata's page says
"[PROBLEM: SPREADSHEETS DON'T SCALE] Replace Manual Tracking with Continuous Automation": spreadsheets are what the product replaces; an import is not described on the page.
Source, read 24 Sep 2026What Cyberday's page says
"Bulk item management: Easily add multiple documentation items at once" and "Quick exports: Export data to Excel"; a spreadsheet import is not described on the page.
Source, read 24 Sep 2026Buying and using it
Packs without an accountPacks bought without an accountStandardOS:YesSix packs, card and email, no accountVanta:Not offeredEvery plan ends in personalized pricingDrata:Not offeredEvery plan ends in personalized pricingCyberday:Not statedSelf-serve subscription; no pack listedSecureframe:Not offeredA quote, from $7,000 a year
What we do
Yes: the six packs are bought on the marketplace with a card and an email address, the files arrive by email, no account.
our pageWhat Vanta's page says
Nothing sold without a conversation: every plan ends in "Get personalized pricing".
Source, read 24 Sep 2026What Drata's page says
Nothing sold without a conversation: every plan ends in "Get Started" and "Get Personalized Pricing".
Source, read 24 Sep 2026What Cyberday's page says
A subscription with a 14-day trial, self-serve; no one-off pack on the pricing page.
Source, read 24 Sep 2026What Secureframe's page says
Nothing sold without a conversation: "Starting at $7,000/year" and "Get a quote" on every package.
Source, read 24 Sep 2026Six EU languagesThe site and the product in six EU languagesStandardOS:YesSix languages, site and productVanta:Not offeredSite in English onlyDrata:Not offeredSite in English onlyCyberday:Not statedSite in English; product count not statedSecureframe:Not offeredSite in four languages
What we do
Yes: English, German, French, Dutch, Spanish and Danish, the site and the product, every page with its five alternates.
our pageWhat Vanta's page says
The site is English only: no language alternates on its pages.
Source, read 24 Sep 2026What Drata's page says
The site is English only: no language alternates on its pages.
Source, read 24 Sep 2026What Cyberday's page says
The site is English; the product "supports many languages and the language choice can be separate for each user", the count not stated.
Source, read 24 Sep 2026What Secureframe's page says
The site in four languages: English, German, Spanish and French, as its language alternates list.
Source, read 24 Sep 2026No consent bannerStandardOS:YesNo cookies on the site, so no bannerVanta:Not offeredOsano consent manager on every pageDrata:Not offeredDataGrail consent dialog on first visitCyberday:Not offeredCookieYes consent banner on first visitSecureframe:Not offeredOsano consent manager on every page
What we do
Yes: the site sets no cookies and shows no banner because there is nothing to consent to; the product sets the session cookie and one short-lived origin cookie, each listed.
our pageWhat Vanta's page says
A consent manager (Osano) on every page and a "Do Not Sell or Share My Personal Information" link in the footer.
Source, read 24 Sep 2026What Drata's page says
A consent dialog (DataGrail) on the first visit: "This website stores data such as cookies to enable essential site functionality, as well as marketing, personalization, and analytics", with "Accept All" and "Accept Essentials Only".
Source, read 24 Sep 2026What Cyberday's page says
A consent banner (CookieYes) on the first visit: "We use cookies to enhance your browsing experience and analyze our traffic", with "Accept All", "Reject All" and "Customize".
Source, read 24 Sep 2026Read on 24 September 2026 from each platform's own pages; a cell that says a platform's pages say nothing is not a claim that the platform cannot. Corrections: contact.
- PlatformStandardOS vs VantaPrice model as published, EU hosting, frameworks, what we do not do.Read 14 Sep 2026
- PlatformStandardOS vs DrataPrice model as published, EU hosting, frameworks, what we do not do.Read 14 Sep 2026
- PlatformStandardOS vs CyberdayPrice model as published, EU hosting, frameworks, what we do not do.Read 14 Sep 2026
- PlatformStandardOS vs SecureframePrice model as published, EU hosting, frameworks, what we do not do.Read 14 Sep 2026
- ConsultantStandardOS vs a consultantWhat is bought, who holds the evidence, year two and three; the price is not the axis.Read 14 Sep 2026
- SpreadsheetsStandardOS vs spreadsheets and a shared driveThe record's date, clause coverage, month fourteen, leaving.Read 14 Sep 2026
Choosing the attestation before the platform: ISO 27001 vs SOC 2 in Europe, from EU tender data.
See the price before you talk to anyone
€249/mo excl. VAT, flat per organization, every feature, unlimited people; the trial writes your Statement of Applicability in the first fifteen minutes.