Home Page | Previous Page |
What is Drata?
Drata is a security and compliance automation platform that continuously monitors your controls, collects evidence from your tech stack, and maps it to frameworks like SOC 2, ISO 27001, HIPAA, GDPR, and others to keep you audit-ready year-round.
Drata is the system where your controls live end-to-end—from definitions and mappings, to automated tests, to policies and evidence:
Each control has its description, scope, owners, mappings, tests, policies, and evidence represented in the platform.
Monitoring tests and evidence drive whether your controls are “Ready” for the frameworks you’re responsible for.
The Control Owner Role
As a Control Owner, you play a critical role in maintaining your organization’s compliance and risk posture. Controls are the backbone of your security and compliance program — they ensure the organization continuously meets regulatory, framework, and customer trust requirements.
Drata empowers you to manage these controls proactively, receive timely notifications, and contribute directly to your company’s compliance success — without needing to be a compliance expert.
How Drata Benefits You:
It gives you a clear to‑do list: which controls you own, which are failing or missing evidence, and what needs remediation.
It centralizes everything auditors will ask you about (policies, evidence, approvals, test results) in one place you can reference instead of digging through email and shared drives.
It lets you prove that your control is designed, implemented, and operating effectively via linked tests and evidence—directly impacting audit outcomes and risk posture.
Drata is the system where you:
See the controls you own, their readiness status, and related tests, policies, and evidence.
Receive tasks and notifications when you need to review or remediate controls or respond to required approvals.
Your Primary Focus
As a Control Owner, your responsibilities are:
Understand your assigned controls – what each control is intended to achieve and which framework requirements it supports.
Keep controls “Ready” – ensure required policies, automated tests, and evidence are in place and current.
Act on tasks & test failures – remediate failed tests, provide manual evidence where automation doesn’t exist, and respond to approval workflows.
Work with your GRC team to:
Understand control responsibilities
Agree on evidence cadence (e.g., quarterly reviews)
Align on change management when ownership or process shifts.
What You Can Do in Drata
With the appropriate role, Control Owners can:
View and edit controls they own (scope, descriptions, mappings, and owners).
View and act on Monitoring tests tied to their controls (run tests, review failures, help tune exclusions).
Add and manage evidence in the Evidence Library and link it to controls (including renewal dates).
Work through Tasks (general, control tasks, evidence renewals) and mark them complete.
Participate in required approvals and respond to control update notifications as configured by Admins.
How to Access Drata
You’ll usually sign in via your company SSO (Okta or Azure AD) or using your normal work account and be taken into your organization’s Drata tenant and workspace(s).
Your internal Admin / Security team controls your role assignment and which workspaces you can see.
Notifications
Personal notifications (recommended):
Under Settings → Notifications, enable:
Status updates for controls assigned to me – periodic digest of your control readiness.
Control approval notifications assigned to me – when controls you own require or receive approvals.
Control updates / internal notes – changes to your controls, new evidence, or notes.
Task reminders – upcoming and past-due task emails so you don’t miss deadlines.
Company-level Slack/Teams notifications may also surface:
Controls not ready
Tests with errors
Required approvals and control evidence updates (if Admins configured these).
Key First-Actions in Drata
Go to Controls and filter by Owner = you to see your list of assigned controls.
For each control:
Review linked framework requirements, policies, tests, and evidence.
Confirm the control description, scope, and ownership are accurate.
Check the Monitoring tab for failed or erroring tests tied to your controls and align with Admins on remediation and exclusions.
Open Tasks and prioritize any control-related work or evidence renewals assigned to you.