💡 Still using the classic Drata experience? Refer to Policy Center: Link your policies to your controls for the original UI.
When a policy is mapped to a control, Drata can:
Track which policies support each control requirement
Include policies in control readiness evaluations
Run policy-related compliance tests where applicable
This article explains how to manually map policies to controls. To learn more about AI-generated suggestions for mapping controls to policies, see AI Suggestions: Controls to Policies.
Prerequisites
Your ability to map controls depends on your account configuration and assigned role.
For accounts without workspaces, the following roles can map policies to controls:
Admin
Information Security Lead
Policy Manager (can map from Policy Center and Controls page)
Control Manager (can map existing policies from the Controls page only)
For workspace-enabled accounts, the following roles can map policies to controls:
Admin
Information Security Lead
Workspace Manager
Map from the Policies page
Open the Policies page.
Select a policy.
Open the Controls tab.
Select Map Controls.
Select the controls you want to associate.
You can also view all currently mapped controls from this tab.
Map from the Controls page
Open the Controls page.
Select the control you want to update.
Go to the Policies tab.
Select Add.
Choose one or more policies to map. To create a new policy during this step, select Create a new policy.
Select Save.
Replace vs manually mapping: what’s the difference?
Customers often create a custom policy and manually map it to the same controls as a Drata template. While this creates a policy-to-control relationship, it does not replace the template’s automation.
When to replace a Drata template
If your custom policy is intended to take the place of a Drata template (such as Information Security, System Access Control, or Vulnerability Management), use the Replace workflow.
Replace ensures:
Existing control mappings carry over
SLA monitoring remains intact
Automated tests continue without gaps
The Drata template is properly transitioned
You cannot archive policies with active SLAs simply by creating a custom policy and mapping it to the same controls. If your goal is to substitute a Drata policy with an SLA, use the Replace workflow to replace it with your custom policy.
Use manual mapping when adding supplemental policies
Manual mapping is best for:
Additional or supporting policies
Policies that do not correspond to a Drata template
Unique internal requirements
Manual mapping does not transfer automated tests or SLA behavior from Drata templates.