Risk categories serve a few key purposes:
Organization and filtering:
Categories let you label and group risks so you can filter them in the Risk Register.
For example, in Risk › All risks, you can filter by category to see only risks of a certain type.
Insights and dashboards:
Once applied, categories become a filter in Risk › Risk Insights, so you can view aggregate risk data by category.
Custom use cases:
You can create categories for anything meaningful to your organization.
For example, you might add a category called
Exceptionto track active risk exceptions at a dashboard level.
Drata also includes out-of-the-box categories (for example, Access Control, Asset Management, Software Development, and Privacy – Data Protection) that align with common risk domains.
Prerequisites
Your account has Risk Management Pro enabled.
You have the Admin or Risk Manager role.
You are using the New Experience. These navigation steps apply to the New Experience; the Classic Experience uses different navigation.
Manage custom risk categories
Use the Categories tab in Risk settings to create, search, and delete custom risk categories.
Note: If you don't see the Categories tab, check the following:
Your account has Risk Management Pro enabled.
You have the Admin or Risk Manager role.
You are using the New Experience. These navigation steps apply to the New Experience; the Classic Experience uses different navigation.
Open the Categories tab
Go to Risk › Settings.
Select the Categories tab.
Here you can create, delete, and search for all of your custom categories.
Create a custom risk category
You can create a custom category directly from a risk while you add it to the Risk Register.
Go to Risk › Registers.
Select a Register and create a new risk.
In the risk details section, locate the Categories field.
Enter the new category name, and then select it to create and apply the category.