Audit Package

Drata audit package contains data from four sources:

For monitored controls, we automatically attach relevant evidence based on audit dates selected by the auditors.

Almost all monitored controls (except for controls related to personnel compliance) include this type of evidence. To see a full list of these controls, navigate to your Controls page and filter by Monitored. You may have to scroll down the filters to filter for your monitored test. Select your desired control and within the drawer scroll to Automated Testing and select the desired test to select the results icon () to view the raw results. You will then be redirected to the events on the Event Tracking page for more information.

In the audit package, we include linked policies and/or external files/URLs.

Manual evidence attached to any control should be available in the audit package. To see this evidence for a specific control, select the desired control and then within the drawer, scroll down to the Control Evidence section and then select Download Files.

In the audit package, we produce three folders, one for current employees, another for new hires, and a third for former employees, which contain all the necessary information for the auditor's selected personnel samples. Additionally, we produce a policy acceptance overview CSV for each category. The policy acceptance overview provides a summary and breakdown of the sampled personnel’s policy acceptance statuses on active policies. To see sample personnel evidence, go to 'Personnel', select any employee or contractor, go to the menu above, and select 'Download'.

Note: The downloaded PDFs have different levels of information based on the status of the personnel. Additionally, the ‘Policy acceptance overview’ CSV excludes offboarded personnel from your sampling.

Any controls related to personnel compliance should include this evidence. (Some examples: DCF-32, DCF 36, DCF-37, DCF-39, DCF-40, DCF 44, DCF 45, DCF-48, DCF-49, DCF-50, DCF-51, DCF-52). Learn more about personnel at Personnel Overview.

Note: You may only see a subset of these controls depending on your frameworks.

These are controls with special treatment in Drata. Data for each control can be found in different part of the application.

For current personnel, the associated PDFs have additional sections (aka 'Special Evidence'—including background check, accepted policies, device data, etc. For former personnel, less information will be included in the PDF.

Note: To learn more about how the Control Evidence Package is generated, and how to see updated evidence, go to this Audit Hub help article, and scroll down to the "The Auditor can also have additional functionality that allows them to:" section.