HERE'S WHY
The 'Personnel' page provides you one place to easily see where all employees stand on key compliance items and follow up with them accordingly.
BEFORE DIVING IN
Only account administrators or information security leads have access to this section within Drata. Data on personnel can come from IDP, HRIS, or manually (for former personnel).
HERE'S HOW
On the 'Personnel' page, you are able to filter using 3 methods:
You can filter by compliance status (Ex: Security training not complete)
You can filter by employment status of personnel
You can filter by personnel group (Only if groups are enabled in your IDP. To learn more about setting up groups, you may click here)
You can also search for a specific person by name or by job title using the search box in the upper right hand corner.
SUMMARY VIEW
Once you have filtered to the population or individual you're looking to view, you have a plethora of information at your fingertips. If you click on the filter at the top, it will change the order of the personnel based on compliant and non-compliant. The default summary view has this information:
"Contact Info" – Names, emails, and job titles are listed first.
The job title is retrieved from your HRIS connection and/or IdP. If the job title is blank for personnel from your HRIS, or you don’t have an active HRIS connection, Drata will retrieve it from your IdP. If your IdP has no job title information, it will remain blank. In the event both your HRIS and IdP connection provides job title details, Drata will use your HRIS connection as the primary source of truth for job title information.
“Currently Compliant?” – if someone is compliant, they will have a green check. If they are not compliant, it will instead be a red mail icon.
By clicking that mail icon, you can send a reminder email to the employee to complete their employee onboarding steps (leading to compliance). Below you will see an example of the email that would be sent.
“Status” – Then, their 'Status' allows you to distinguish between those that are current employees, former employees, current contractors, former contractors or accounts that are out of scope.
“Accepted Policies” – If that personnel has accepted all policies assigned to them, you will see a green check mark. If not, you will see a red “x”.
“Identity MFA” – If that personnel has activated MFA on the identity provider, you will see a green check mark. If not, you will see a red “x”.
“BG Check” – If that personnel has a completed background check, you will see a green check mark. If not, you will see a red “x”. If that individual was given an exclusion from the background check, you will see a gray person icon with a check mark.
“Security Training” – If that personnel has completed all assigned security training, you will see a green check mark. If not, you will see a red “x”.
“HIPAA Training” – If that personnel has completed HIPAA training, you will see a green check mark. If not, you will see a red “x”.
DETAILED VIEW
If you’d like to view a more detailed list of columns, you may click on the gear icon on the top right and select “detailed”.
The detailed view has this information:
"Status Sync" – You may need or want to be able to reset manual changes made to a personnel record. Currently, if you make a manual change, that disables the ability for the IdP and HRIS to sync and bring in more data for that particular field. This reset functionality will allow you to account for an error or mistake. Learn more!
"Drata Agent Installed" – A green shield will be present once the Drata Agent has been installed by this employee.
"Password Manager" – If the Drata Agent identified a Password Manager on this employee's computer, a green checkmark will be present.
"Auto Updates" – If the employee has enabled auto updates, a green checkmark will be visible here.
"Disk Encrypted" – The Drata Agent will confirm the employee has their disk encrypted.
"Anti-Virus" – The Drata Agent will ensure the employee is utilizing an anti-virus software and if so, a green checkmark will be present.
"Lock Screen" – Employees will configure their screen to require a login if the screen saver has been active for 60 seconds. If this is true, you will see a green checkmark.
"OS Version" – The Drata Agent will record the Operating System currently installed on the employees computer.
"Workstation Serial #" – The computer serial number will be listed here.
"Apps" – The number of apps the employee has on their device will be reported here. For more details on what the apps are, click the arrow to the right and scroll down to apps.
"Hire Date" – you will see the 'Hire Date', depending on the connections you have set, this will be pulled from either your Identity Provider or HRIS (HRIS is the default if connected). If only an IdP is connected, the date the record was created will be used as the Drata Hire Date. If an employee leaves or is let go, you will see their 'Separation Date' displayed. If only an IdP is connected, the date the record was suspended or deleted will be used as the Drata Separation Date. You also have the ability to manually edit or update these fields by clicking on the date and using the calendar modal to select the intended 'Hire Date' or 'Separation Date'. Note that performing this action blocks subsequent IdP and HRIS syncs on this personnel record. To reenable this sync, please see this article.
The remaining fields are pulled in via the Drata Agent or completed via employee onboarding to ensure compliance.
When you click the arrow to the right at the end of an employee row, a drawer will open with more details. You will see dates and times for when each check was last performed. You will also see the option to upload a background check for an employee. When you click the 'Add Background Check' button, you will be given the option to paste in a link to the completed background check as well as the data on which it was completed.
You can also view or upload evidence for the security training and MFA by clicking 'View/Upload Evidence'.
DOWNLOAD
In the upper righthand corner of the 'Personnel' page, you will also see the option to 'Download All'. This will allow you to export a CSV of all employees and their compliance status for each of the above mentioned factors.
Note: When you select the option to 'Download All', you will see a dropdown menu allowing you to select your current filtered view for the export or to export all.
Action
You may access a list of company-wide actions from the action menu on top. These actions are available when no checkboxes for individual personnel are checked.
Add Former Personnel: When you click the button a drawer will extend from the right side of the screen allowing you to enter in details for a former employee you'd like to add to Drata for tracking purposes and for linking to other accounts (ex. infrastructure accounts to show an audit trail for access control).
Reset Security Training: Allows you to reset security training requirements for the entire organization.
Reset HIPAA Training: If you have purchased HIPAA, it allows you to reset HIPAA training requirements for the entire organization.
BULK ACTION
You want to execute and review personnel tasks in bulk efficiently. A company might have 500+ people and right now the only way an admin can break down the Personnel view is based on employment status. This makes it hard to view the data and any action taken for a group. This section discusses the actions that can be performed when one or more checkboxes for personnel rows are checked.
OVERVIEW
Filter: Before performing bulk actions, you have the option to narrow down users from the filter menu on the left. Personnel table comes with 3 filters:
Compliance : Allows selecting a group of users that are missing a specific compliance requirement.
Status: Allows selecting a group of users based on employment status
Group: allows you to view users base don the groups that you have set up in your identity provider.
Enabling the bulk actions: Once you are in the Personnel page, you can select multiple personnel at a time. This automatically takes you to the bulk action mode:
Selection options: You have 3 options to decide how many users to select:
Select individual employees by clicking on the checkbox next to the name(s)
Select everyone on the current page by clicking on the checkbox on the top row
After entire page is selected, they can click on the link above the table to select everyone in the organization
The user can now perform four different types of Bulk Actions.
Send Reminder: allows sending email reminders to non-compliant users at once.
Change Employment Status: allows setting employee status, hire and separation dates for multiple employees. Note that performing this action blocks subsequent IdP and HRIS syncs on these personnel records. To reenable this sync, please see this article.
Attach Evidence: Allows attaching MFA, Security Training, Background check evidence to all selected users.
Exclude Background Check: Allows excluding a personnel from background check. For example, you can set up a group in your identity provider with all people that should be excluded from background check. Once that group is set up, you can use the personnel filter to select all the personnel in that group and perform the background exclusion. When a personnel is excluded from background check, the below icon will be displayed for that person.
The icon, any previously uploaded evidence, and the reason for excluding the background check will be included in the personnel details drawer.