The Risk Library contains a predefined set of risks based on industry standards such as NIST SP 800-30, ISO 27005, OCR SRA, and other recognized frameworks. These risks are designed to help you quickly build and populate your Risk Register.
You can add any risk from the Risk Library to your Risk Register. Once a risk is added, it becomes part of your register and can be assessed, assigned, and managed like any other risk.
Standard risks in the Risk Library are read-only and cannot be edited directly. After adding a risk to your Risk Register, you can modify its details to reflect your organization’s specific context. If you need to reference Drata’s original, standardized risk descriptions, you can always view them in the Risk Library.
Add a risk to your register
You can add a risk to your register by:
Navigate to Register page.
Select the desired Risk Register to add a risk into.
Open the Library tab.
Do one of the following:
Select the ellipsis (⋯) next to a risk and choose Add to register, or
Select the checkbox next to one or more risks, then click Add to register.
Delete a risk from your register
Deleting a risk is permanent and cannot be undone. The risk's data is removed from your account, including any updates you made to its scoring, treatment plan, notes, and mapped controls.
If the risk came from the Risk Library, you can always add it back from the Library tab. This adds back the original, unedited Library template, not the risk you deleted. Any customizations you made, such as an updated description, scoring, owners, categories, or notes, are not recovered.
If the risk is a custom risk, it is not stored in the Risk Library. If you delete it, it is removed permanently and cannot be added back or recovered.
Want to keep a record instead? Update the risk's status to Archived or Closed rather than deleting it. Status changes can be reversed. Deletion cannot.
Delete a risk
Select the ellipsis (⋯) next to the risk.
Select Delete.
