Adding relevant, up-to-date evidence helps keep controls ready and prevents audit gaps. Always ensure uploaded artifacts directly support the controls they're mapped to. Outdated or incorrect evidence can negatively impact control readiness.

You can upload evidence directly from your computer or from a connected cloud storage provider.

Upload rules

File Size Limits

The evidence is added to the Evidence Library and linked to any selected controls.

You can also add evidence directly while working on a control.

Drata allows you to link evidence directly to a control in order to build a repository for your audit. This eliminates the need for a separate storage place for those controls that do not have continuous monitoring tests in Drata.

Admins, Information security leads, Workspace managers, Control managers, DevOps engineer have access to this section within Drata.

On the Controls page, select a control to access the control drawer. On the control drawer, scroll down to CONTROL EVIDENCE section.

To add miscellaneous evidence, select Add within the Miscellaneous evidence section. A modal will appear. On the modal, there are two tabs: File and URL. If you would like to upload a file, select the File tab and if you would like to enter a URL, select the URL tab.

Uploading a file:

When uploading a file, you can include a name and description, but if you opt not to do so, the file name will be populated as the name of the evidence. You are required to enter a creation date and a renewal date – these dates are used to determine the readiness of a control.
​
The approved file types include: pdf, docx, odt, xlsx, ods, pptx, odp, gif, jpeg, jpg, png, csv, zip, txt, json, markdown, and md. The file upload max size is 25MB.

Adding a URL:

When adding a URL, you're required to add a name, creation date, and renewal date. You can optionally enter a description. A .csv file with the URL(s) will be available when downloading external evidence.

Save when all the information has been entered. Learn more about the controls here.

To edit a file or URL, select the edit icon on the evidence you'd like to update. Make any changes you'd like to make and click the save button.

Effective policy management starts with using the Policy Center as a centralized repository. Manually linking these policies to controls ensures clear traceability, simplifying audits and compliance checks.

On the Controls page, select a control to access the control drawer. On the control drawer, scroll down to POLICIES section.

To link a policy, select Add within the Link policies within Drata section. A modal will open including all of the policies you currently have in Drata.

To link a policy, check the policies you would like to link and select Save. If you want to create a new policy, select Create a New Policy in the upper right corner of the modal.

Note: Drata's templated policies have been automatically mapped to the applicable controls. You can unlink a pre-mapped (or any) policy at any time.

Additionally, policies published in Drata may not automatically appear in the Trust Center. This manual inclusion allows organizations to manage which policies are publicly visible, ensuring only relevant and appropriate information is shared externally.