Risk Management in Drata helps you identify, evaluate, and manage risks that could affect your organization. Many compliance frameworks, including SOC 2 and ISO 27001, require organizations to perform risk assessments as part of an ongoing risk management program.

A risk assessment is the process of identifying and evaluating potential risks. While risk management is continuous, most organizations review and update risks on a regular cadence to reflect changes in technology, business operations, and the threat landscape.

You can access Risk Management from the Risk section.

The layout may vary depending on your role and permissions, but core functionality remains the same.

The Register tab displays your organization’s active risks, assessment progress, and Residual risk posture.

Key metrics include:

The Assessment Progress graph shows the percentage of risks that have been assessed and your Residual risk posture. A risk is considered assessed once it has an inherent score.

You can view the Risk Posture graph directly on the Risk Management page or from Risk Insights.

The Risk Posture graph groups risks into severity categories based on score ranges. Each color block represents a severity level and displays the number of risks within that range. You can select a block to view associated risks in the table below the graph.

This table displays the default colors, severity labels, and the threshold values.

Pro feature
With Risk Management Pro, you can customize the thresholds, including the threshold names and their meanings in the Risk Settings.

In Risk Management, risks are evaluated using impact and likelihood values, which are used to calculate risk scores.

The table below explains how each scoring-related column is used.

By default, Risk Management uses a fixed 1–5 scoring scale for both Impact and Likelihood:

These scoring values are preset to ensure consistency across risk evaluations.

Pro feature

Custom scoring options are available with Risk Management Pro. To customize scoring, an upgrade to Risk Management Pro is required.

You can manage risks in bulk by selecting multiple risks in the table and choosing an available action.

Bulk actions include:

Select Download to view additional export options, including risk reports, treatment plans, and CSV exports. You can also create custom risks to reflect scenarios unique to your organization.

To learn more, view: How to Manage Custom Risks

Risk Management is a continuous process of identifying, assessing, managing, and monitoring risks that could impact the security, reputation, and financial health of a company. In an ever connected world where cyber attacks are evolving and increasing in frequency and severity, the need for a proactive and integrated risk management program is critical to the security posture of any organization.

You can access the Risk Management module on the left navigation menu.

The appearance of the following screenshot may differ based on your roles and permissions. However, the Risk Management module will still be located in the left navigation menu.

Register tab

At the top of the page, you'll find an overview of your risk register posture, which includes two key metrics:

These active risks collectively define your risk posture, helping you assess and prioritize mitigation efforts.

Filter

To filter risks, select the Filter button and choose your desired criteria.

To display the filter menu, select the first option next to the filter heading:

To hide the filter menu, select the second option next to the filter heading:

Select the Download button to select which report you'd like to download.

Download Report:

Download CSV:

In order to see available actions, you must select risks from within your register using the checkboxes on each row. Select which risks you would like to perform a bulk action on, and then select the "Actions" menu.

To access available actions:

Each threat-based risk item includes key details such as Risk ID, description, category, control mapping, assessment score, and more—displayed in the risk register table.

Risks from Drata's library come with a default category, which can be modified as needed.

Hover over the owner’s icon to view the list of assigned owners for a risk.

Each risk needs to be analyzed through the threat impact and likelihood, and scored to be considered an assessed risk. You can select a score for your impact and your likelihood. The total score will be the impact multiplied by likelihood.

Note: We support custom scoring. To customize your scoring, go to Custom Risk Scoring & Legend. It is critical to ensure that the scoring on your report mirror the same scoring on your Risk Assessment Policy

To score from the risk row, click on the dropdown and select a score. You may have to scroll the table to the left.

When scoring from the risk row, a default value of “Needs Treatment” will be applied to the risk until you select an actual treatment response/method.

Note: You may also assess a risk by opening the drawer and scrolling down to the “Assessment” section of the drawer

Clicking on a row will open the risk drawer. From here you can edit all of the risk's data. It contains the following fields, all of which are editable and optional unless noted:

Drata's Risk Library is pre-loaded with over 200 risks based on NIST SP 800-30, ISO 27005, OCR SRA, and other industry standards, from which you can use to build your Risk Register.

Each of Drata's risks in the library can be added to your register. Once added, you'll see a link to the risk in your register on the "Manage in Register" button.

Drata's standard risks cannot be edited within the context of the library. Once you add them to your register, they can be edited. If you ever need to refer back to Drata's standard language for risks, you can find them in the library.