💡 Still using the classic Drata experience? Refer to Exporting your control mapping for the original UI.
Overview
Auditors and internal teams often request a clear view of how controls map to framework requirements. Drata allows you to export control and requirement mappings as a CSV file, making it easy to share, review, or include in audit documentation.
Export control mappings
To download a CSV file with your control and requirement mappings:
Go to the Frameworks page.
Select a framework to open.
Select Downloads.
Choose one of the following export options:
Requirements to controls
Controls to requirements
Export options explained
Requirements to controls
This export starts from the framework requirements (for example, SOC 2 Trust Services Criteria).
Each requirement appears as a separate row
Mapped controls are listed for each requirement
A single control may appear multiple times if it maps to multiple requirements
This format is useful when auditors want to review coverage starting from the framework.
Controls to requirements
This export starts from the Drata Control Framework.
Each control appears once
All mapped requirements are listed for that control
This format is useful when reviewing how individual controls support compliance requirements.
Download all requirements
What it does: Downloads every requirement in the framework, regardless of any filters you currently have applied.
Use this when:
An auditor asks for the full framework mapping
You want a complete, authoritative export
You’re preparing for an audit or external review
Download filtered view
What it does: Downloads only the requirements based on your applied filters.
Use this when:
You’re reviewing a subset of requirements
You want to share only what’s relevant (for example, out-of-scope exclusions, specific domains, or statuses)
You don’t need the full framework
What’s included in the export
The file downloads as a CSV
Only in-scope controls are included
Controls marked Out of Scope are excluded from the export
When to use this export
Use control mapping exports when you need to:
Share control coverage with auditors
Perform internal compliance reviews
Validate mappings across frameworks
Support audit preparation and evidence requests
Key takeaways
Control mappings can be exported at any time
Two export formats support different audit and reporting needs
Out-of-scope controls are automatically excluded
CSV exports make sharing and review simple