💡 Still using the classic Drata experience? Refer to Marking Controls In and Out of Scope for the original UI.
Overview
Not all controls are required for every audit. Drata allows you to mark controls as In Scope or Out of Scope so your audit reflects only the controls your organization plans to use.
Marking controls out of scope helps you:
Focus on relevant audit requirements
Reduce noise during audit preparation
Clearly document which controls are intentionally excluded
Prerequisites
Only the following roles can mark controls in or out of scope:
Administrators
Information Security Leads
Mark controls out of scope
To mark one or more controls as out of scope:
Go to the Controls page.
Select one or more controls from the list.
Mark the selected controls as Out of Scope.
The selected controls are excluded from audit scope and readiness calculations where applicable.
Mark controls in scope
To mark controls back in scope:
Go to the Controls page.
Select one or more controls.
Mark the selected controls as In Scope.
Once marked in scope, controls are included again in audit preparation and readiness tracking.
What to expect after changing scope
Out-of-scope controls remain visible but are excluded from audit scope
In-scope controls contribute to readiness and audit workflows
Control scope is global.
When you mark a control In/Out of Scope from the Controls page, it affects all frameworks that control is mapped to
If the control is mapped to multiple frameworks, the scope change applies to all of them.
Framework behavior is driven by mappings and requirements.
A framework’s control count and readiness are based on in‑scope controls that are mapped to in‑scope requirements in that framework.
Adding or removing a control from a framework’s requirements only affects that specific framework.