Home Page | Previous Page |
What is Drata?
Drata is a security and compliance automation platform that continuously monitors your controls, collects evidence from your tech stack, and maps it to frameworks like SOC 2, ISO 27001, HIPAA, GDPR, and others to keep you audit-ready year-round.
Drata’s Policy Center is where policies are authored, reviewed, approved, published, mapped to controls, and renewed, all in the same system that tracks your controls and evidence.
As a Policy Owner, you are responsible for ensuring that your organization’s security, privacy, and compliance policies accurately reflect how the company operates - and that every employee understands and adheres to them.
Policies are the foundation of your organization’s compliance framework. They translate requirements (like SOC 2, ISO 27001, HIPAA, and GDPR) into actionable standards for employees, and demonstrate to auditors and customers that your company is committed to protecting data and operating securely.
Why it matters to you
It gives you a structured, auditable policy lifecycle (draft → review → approve → publish → renew) without needing separate tools or manual trackers.
It ensures your policies are directly tied to controls and frameworks, so your work has a measurable impact on compliance status and audit evidence.
It centralizes policy notifications and ownership so changes, reassignments, and updates are captured and communicated automatically instead of through ad‑hoc emails.
Your Primary Focus
Ensure all required policies are authored, approved, published, and renewed on schedule.
Confirm policies are mapped to controls so they count toward control readiness and test logic.
Respond to changes and maintain policy integrity across reviews, edits, and ownership changes.
What You Can Do in Drata
As a Policy Owner / Policy Manager you can:
Create or upload policies (Drata templates or your own files) and manage versions.
Configure approval workflows: approvers, tiers, and required vs. optional approvals.
Track and manage policy renewal dates and review cadence.
Map policies to controls, so Monitoring and readiness calculations reflect your documentation properly.
Monitor acknowledgments (My Drata / personnel acknowledgment) as part of evidence, depending on your configuration.
Policy Owner Notifications
Policy Owners automatically receive emails when certain events occur (unless they disable them).
By default, policy owners are notified when:
New Assignment – they are newly assigned as a policy owner.
Removal – they are removed as the owner.
Policy Update – someone else updates their policy.
Access Removal – when a policy owner’s access is removed and the policy is reassigned to an admin.
You can manage this under Settings → Notifications by toggling “Updates to policies assigned to me” on/off.
How to Access Drata
You’ll usually sign in via your company SSO (Okta/Azure AD/etc.) or https://app.drata.com using your normal work account and be taken into your organization’s Drata tenant and workspace(s).
Your internal Drata Admin / Security team controls your role assignment and which workspaces you can see.
Key First-Actions in Drata
Open Policies page and:
Review all policies where you’re listed as Owner.
Confirm content, scope, and assigned approvers.
Check approval status and push any drafts through review/approval workflows so they can be published.
Validate that each policy is:
Mapped to the correct controls and frameworks.
Assigned a renewal date and review cadence.
Ensure notifications are configured so you’re alerted to updates and renewals you care about.
Best Practices for Success
✅ Review policies at least annually, or when regulations or internal processes change.
✅ Collaborate with internal teams to ensure policies align with real-world workflows.
✅ Communicate changes proactively and explain the “why” behind updates.
✅ Use Drata’s Policy Center to track and validate acknowledgment.
✅ Encourage open feedback from employees to strengthen understanding and buy-in.
Remember:
Policies are the “rules of the road” for compliance. Your stewardship ensures they remain clear, relevant, and effective — transforming compliance from a checkbox exercise into a core part of your