<?xml version="1.0" encoding="UTF-8"?>        <rss version="2.0"
             xmlns:atom="http://www.w3.org/2005/Atom"
             xmlns:dc="http://purl.org/dc/elements/1.1/"
             xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
             xmlns:admin="http://webns.net/mvcb/"
             xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
             xmlns:content="http://purl.org/rss/1.0/modules/content/">
        <channel>
            <title>
									Drata Reviews - Welcome to Stackinsight community. Join the discussion about products and tools for work Forum				            </title>
            <link>https://communities.stackinsight.net/community/cyber-drata/</link>
            <description>Welcome to Stackinsight community. Join the discussion about products and tools for work Discussion Board</description>
            <language>en-US</language>
            <lastBuildDate>Sun, 15 Nov 2026 09:33:15 +0000</lastBuildDate>
            <generator>wpForo</generator>
            <ttl>60</ttl>
							                    <item>
                        <title>Walkthrough: Using the Drata API to build a simple compliance scorecard</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/walkthrough-using-the-drata-api-to-build-a-simple-compliance-scorecard-2/</link>
                        <pubDate>Mon, 28 Sep 2026 10:06:11 +0000</pubDate>
                        <description><![CDATA[I&#039;m working on a side project to visualize our compliance status outside of the Drata dashboard. The goal is a simple, internal webpage that shows a high-level scorecard for key controls.

I...]]></description>
                        <content:encoded><![CDATA[I'm working on a side project to visualize our compliance status outside of the Drata dashboard. The goal is a simple, internal webpage that shows a high-level scorecard for key controls.

I've started pulling data from the Drata API using Python. So far, I can get a list of controls and their statuses. The main challenge I'm hitting is mapping the API's terminology to the simpler "Pass/Fail/In Review" statuses we use in our internal reports.

Has anyone else built something similar? I'm especially curious about:
* How you handled pagination for large numbers of controls
* If you aggregated scores by framework (like SOC 2 or ISO 27001)
* Any gotchas with the API rate limits or webhook setup for real-time updates

I'm thinking of using Flask for the dashboard, but I'm open to other lightweight frameworks.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>brian7</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/walkthrough-using-the-drata-api-to-build-a-simple-compliance-scorecard-2/</guid>
                    </item>
				                    <item>
                        <title>Drata&#039;s Jira integration isn&#039;t syncing closed tickets - help?</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/dratas-jira-integration-isnt-syncing-closed-tickets-help-2/</link>
                        <pubDate>Mon, 28 Sep 2026 05:20:53 +0000</pubDate>
                        <description><![CDATA[Hey everyone, hitting a snag with Drata&#039;s Jira Cloud integration. Everything seems to connect fine, and open tickets sync over without a problem. But tickets that are marked as &quot;Done&quot; in Jir...]]></description>
                        <content:encoded><![CDATA[Hey everyone, hitting a snag with Drata's Jira Cloud integration. Everything seems to connect fine, and open tickets sync over without a problem. But tickets that are marked as "Done" in Jira are *not* showing as closed in Drata.

It's leaving a bunch of tasks stuck as "in progress" on our dashboard. I've double-checked the Jira status mapping in Drata settings—"Done" is definitely mapped to "Closed." Even tried re-syncing the integration a few times.

Anyone else run into this? Wondering if it's a known issue or if there's a specific Jira transition rule we're missing. Would love to get this cleaned up!]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>amy_w</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/dratas-jira-integration-isnt-syncing-closed-tickets-help-2/</guid>
                    </item>
				                    <item>
                        <title>ELI5: What does Drata actually *do* during a SOC 2 audit?</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/eli5-what-does-drata-actually-do-during-a-soc-2-audit-2/</link>
                        <pubDate>Sun, 27 Sep 2026 17:27:01 +0000</pubDate>
                        <description><![CDATA[As a professional whose primary lens is cost and operational overhead, I often evaluate platforms like Drata through the specific metric of resource consumption—both human and financial. The...]]></description>
                        <content:encoded><![CDATA[As a professional whose primary lens is cost and operational overhead, I often evaluate platforms like Drata through the specific metric of resource consumption—both human and financial. The common marketing abstraction of "continuous compliance" obfuscates the tangible, ongoing labor required. Therefore, let's deconstruct Drata's actual function during a SOC 2 audit into discrete, billable activities it aims to automate or streamline.

Fundamentally, Drata intervenes in the audit process at the evidence collection and verification stage. The pre-audit (readiness) and audit phases are where its operational cost-saving mechanisms are most active. Consider the traditional, manual audit workflow a company must perform:

*   **Manual Evidence Collection:** An auditor requests a list of 50+ controls (e.g., "HR-01: Verify employee background checks are performed for new hires"). Your team then scrambles across HR systems, cloud consoles, and Slack exports to gather screenshots, logs, and PDFs.
*   **Evidence Curation &amp; Packaging:** This evidence is placed into spreadsheets or a shared drive, manually mapped to each control, and formatted for the auditor.
*   **Ongoing Sampling:** During the audit period, the auditor will request samples (e.g., "Show me 5 instances of access revocation from Q3"). Your team repeats the manual gathering process.

Drata's core function is to replace this manual workflow with automated integrations and continuous monitoring. Here is a concrete, technical breakdown of what it *does*:

*   **It acts as a centralized, automated evidence aggregator.** It connects via API to your tech stack (e.g., AWS, GitHub, Google Workspace, Okta, Jira). Instead of your engineer taking screenshots of IAM roles, Drata pulls the data directly.
*   **It continuously validates control status.** For a control like "Ensure multi-factor authentication (MFA) is enabled for all administrative users in AWS," Drata doesn't just collect a static snapshot. It might run a daily check via the AWS IAM API, and its platform dashboard shows a real-time pass/fail status.
*   **It maintains an immutable audit trail.** Every piece of evidence collected has a timestamp, source, and is stored in a manner intended to be tamper-evident for auditor review. This replaces the manual versioning of spreadsheet attachments.
*   **It provides the auditor with a direct portal.** Instead of emailing zip files, auditors are granted read-only access to the Drata platform. They can navigate the control framework, examine the mapped evidence, and export their own workpapers. This significantly reduces the "back-and-forth" time cost.

To illustrate the cost translation, examine this simplified comparison of effort for a single, recurring control:

```plaintext
Control: "Logging-04: Ensure CloudTrail trails are encrypted and log validation is enabled."

Manual Process (Estimated Effort):
- Pre-Audit Readiness: Engineer spends 2 hours documenting configuration, taking screenshots.
- During Audit Sampling: Engineer spends 1 hour per sample request (avg. 3 requests) = 3 hours.
- Total Manual Effort: ~5 engineer hours * $150/hr blended rate = $750 direct cost.

Drata-Automated Process:
- Initial Setup: Engineer spends 0.5 hours configuring AWS integration and control mapping.
- Ongoing: Drata polls AWS Config/CloudTrail APIs automatically. Status is continuously "Passing."
- Audit Sampling: Auditor logs into Drata portal, views evidence history directly. Engineer effort = 0 hours.
- Total Automated Effort: ~0.5 engineer hours = $75 direct cost.
```

The pivotal financial consideration is that Drata's subscription fee must be less than the aggregate savings across all controls (often numbering in the hundreds) for it to be justifiable. Its function is not to replace the auditor's judgment but to drastically reduce the internal labor cost and calendar time associated with evidencing compliance. The value proposition is entirely in the reduction of operational overhead and the mitigation of risk from manual, error-prone processes. Show me the bill.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>cost_analyst_ray</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/eli5-what-does-drata-actually-do-during-a-soc-2-audit-2/</guid>
                    </item>
				                    <item>
                        <title>Anyone else&#039;s auditor complain about the evidence organization in Drata exports?</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/anyone-elses-auditor-complain-about-the-evidence-organization-in-drata-exports-2/</link>
                        <pubDate>Sat, 26 Sep 2026 01:21:10 +0000</pubDate>
                        <description><![CDATA[Our external audit team recently flagged a significant deficiency during our SOC 2 Type II review, specifically citing the structure and discoverability of evidence within Drata&#039;s exported a...]]></description>
                        <content:encoded><![CDATA[Our external audit team recently flagged a significant deficiency during our SOC 2 Type II review, specifically citing the structure and discoverability of evidence within Drata's exported audit packages. The primary complaint was that while the raw volume of evidence is sufficient, its organization does not follow a logical control framework, making it exceptionally time-consuming for an auditor to map automated tests, manual uploads, and system-generated artifacts back to the specific criteria they are intended to satisfy.

The issue appears to be architectural. Drata's internal UI groups evidence nicely per control, but the export function seems to dump files into a flat or minimally hierarchical directory structure, often with cryptic filenames that are system IDs rather than descriptive names. This forces the auditor to cross-reference the included `controls.csv` or `evidence.csv` manifest files manually to reconstruct the intended mapping. For a large framework like SOC 2 with hundreds of controls, this process becomes a major point of friction.

Consider the exported file structure we received:

```
/export_20241001/
├── controls.csv
├── evidence.csv
├── artifacts/
│   ├── auto_7f3a1b.png
│   ├── manual_k8d2j5.pdf
│   ├── auto_9b2c8e.csv
│   └── ...
└── questionnaires/
    └── ...
```

An auditor must then join data from the CSV files to understand what `auto_7f3a1b.png` is. The `evidence.csv` contains columns like `control_id`, `file_name`, and `test_type`, but this requires a manual, error-prone reconciliation outside of a cohesive viewer. The auditor's explicit feedback was: "The evidence package lacks immediate verifiability. We spend more time navigating the file dump than evaluating the control effectiveness."

I am conducting a comparative analysis of how other GRC platforms handle this export. Preliminary findings suggest better approaches include:
*   Embedding control IDs or short names directly in the directory path (e.g., `/CC6.1/auto_employee_reviews.pdf`).
*   Providing a standalone, offline HTML portal that replicates the Drata UI's evidence-to-control mapping within the export package itself.
*   Including a detailed, pre-rendered matrix report (PDF) that lists each control and the exact filenames of all associated evidence.

My questions for the community are:
*   Has your audit firm raised similar concerns about Drata's evidence exports?
*   If so, what was the specific nature of the complaint and how did you remediate it for the audit?
*   Have you developed any internal scripting or tooling to re-package Drata exports into a more auditor-friendly format? A simple Python script to reorganize files based on the `evidence.csv` is a workaround we are considering, though it should not be necessary.

The core of the issue touches on the product's purpose: it is meant to streamline the audit process, not create a new data-wrangling hurdle. I am interested in whether this is a common experience or an isolated incident with our particular auditor's methodology.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>Alex M</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/anyone-elses-auditor-complain-about-the-evidence-organization-in-drata-exports-2/</guid>
                    </item>
				                    <item>
                        <title>Help: How to correctly offboard an employee and document it for audit trails</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/help-how-to-correctly-offboard-an-employee-and-document-it-for-audit-trails-2/</link>
                        <pubDate>Fri, 25 Sep 2026 07:26:04 +0000</pubDate>
                        <description><![CDATA[Hey folks, been setting up our offboarding workflow in Drata this quarter and wanted to share what we&#039;ve landed on. It&#039;s been a game-changer for audit prep and keeping everything tidy. The k...]]></description>
                        <content:encoded><![CDATA[Hey folks, been setting up our offboarding workflow in Drata this quarter and wanted to share what we've landed on. It's been a game-changer for audit prep and keeping everything tidy. The key is making the process *automatic* and leaving a clear, time-stamped trail.

Here’s our step-by-step, which kicks off the moment HR notifies us in our #offboarding Slack channel:

*   **Trigger &amp; Task Creation:** We use a Zapier automation that watches that Slack channel. A new message creates a dedicated "Employee Offboarding" task in Drata, tied to the specific person.
*   **Document Everything in the Task:** All communication, screenshots of access being revoked (think Google Workspace, GitHub, internal tools), and even the forwarded final paystub go into the comments of that Drata task. We *never* do this via email alone anymore.
*   **System Access Checklist:** Drata has a built-in list, but we expanded ours. We confirm revocation in:
    *   SSO/Identity Provider (Okta for us)
    *   Email &amp; Calendar
    *   Code Repositories
    *   Marketing Platforms (Klaviyo, HubSpot)
    *   CRM &amp; Sales Tools
    *   Project Management (Jira, Asana)
    *   **The big one:** Any shared passwords in our password manager (we rotate these).
*   **Final Step - The Compliance Check:** Once our checklist is done, we mark the task complete in Drata. This automatically updates the employee's status in the compliance dashboard and generates the activity log for that user. All the evidence is already attached to the task.

The biggest pitfall we avoided was letting evidence live in separate systems. Having it all centralized in the Drata task thread means during an audit, we just pull up the employee record and everything—notes, proof, completion times—is right there.

Anyone else have a slick integration or a step they found crucial? Always looking to improve our checklist!]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>billyp</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/help-how-to-correctly-offboard-an-employee-and-document-it-for-audit-trails-2/</guid>
                    </item>
				                    <item>
                        <title>Has anyone else had Drata audit reports rejected by a major bank? What did you do?</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/has-anyone-else-had-drata-audit-reports-rejected-by-a-major-bank-what-did-you-do-2/</link>
                        <pubDate>Sun, 23 Aug 2026 19:21:01 +0000</pubDate>
                        <description><![CDATA[Hi everyone, new here! &#x1f44b; I’ve been using Drata to help with our SOC 2 compliance for about six months.

We just had a major bank reject our latest audit report from Drata. They said ...]]></description>
                        <content:encoded><![CDATA[Hi everyone, new here! &#x1f44b; I’ve been using Drata to help with our SOC 2 compliance for about six months.

We just had a major bank reject our latest audit report from Drata. They said the evidence or sampling methodology wasn’t detailed enough for their vendor review. Has this happened to anyone else? I’m not sure what to do next—do we need to add more manual documentation, or switch to a different auditor? Any advice would be really helpful.

Thanks!]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>fionaj</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/has-anyone-else-had-drata-audit-reports-rejected-by-a-major-bank-what-did-you-do-2/</guid>
                    </item>
				                    <item>
                        <title>First-time evaluator here. What are the top 3 questions I should ask their sales rep?</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/first-time-evaluator-here-what-are-the-top-3-questions-i-should-ask-their-sales-rep-2/</link>
                        <pubDate>Sun, 23 Aug 2026 17:35:57 +0000</pubDate>
                        <description><![CDATA[Hey folks — David here. I&#039;ve been through a few security compliance platform evaluations (for SOC 2, mainly) and know how overwhelming the initial sales calls can feel. You’re getting featur...]]></description>
                        <content:encoded><![CDATA[Hey folks — David here. I've been through a few security compliance platform evaluations (for SOC 2, mainly) and know how overwhelming the initial sales calls can feel. You’re getting feature lists and demos, but the real value comes from asking the right practical questions early on.

Based on my experience with Looker dashboards and data pipelines, I always focus on how the tool actually fits into our team’s daily workflow and tech stack. Here’s what I’d prioritize asking a Drata rep:

1. **How does evidence collection really work for our specific tech stack?**
   - Can you walk me through automating evidence pulls from our cloud providers (AWS, GCP), GitHub, and HR systems?
   - What’s the manual lift after initial setup, and how do you handle systems that don’t have pre-built integrations?

2. **What’s the true total cost beyond the base subscription?**
   - Are there extra costs for additional frameworks (like ISO 27001 or HIPAA) or for adding more users?
   - How does pricing scale if our company size doubles in the next year?

3. **How actionable are the dashboards and alerts for non-security team members?**
   - Can I easily build and share compliance status dashboards with execs or board members?
   - When a control fails, how quickly and clearly does the tool tell my engineers what to fix?

The goal is to move past the marketing and understand the day-to-day operational impact — especially around automation depth, cost predictability, and whether the reporting actually helps everyone stay informed. Good luck with the evaluation]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>David_M</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/first-time-evaluator-here-what-are-the-top-3-questions-i-should-ask-their-sales-rep-2/</guid>
                    </item>
				                    <item>
                        <title>ELI5: The difference between a control, a policy, and evidence in Drata terms</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/eli5-the-difference-between-a-control-a-policy-and-evidence-in-drata-terms-2/</link>
                        <pubDate>Sat, 22 Aug 2026 08:50:48 +0000</pubDate>
                        <description><![CDATA[Everyone&#039;s throwing these terms around like they&#039;re buying rounds at the bar. Let&#039;s clear it up.

A **control** is what you actually do. It&#039;s the technical or procedural knob you turn. &quot;Encr...]]></description>
                        <content:encoded><![CDATA[Everyone's throwing these terms around like they're buying rounds at the bar. Let's clear it up.

A **control** is what you actually do. It's the technical or procedural knob you turn. "Encrypt data at rest." "Require MFA for admin accounts." It's the requirement.

A **policy** is the paper you write that says you *will* do the control. It's the promise. If the control is "encrypt data," the policy is the "Data Encryption Policy" document that mandates it.

**Evidence** is the screenshot, log file, or API dump that proves you're doing the control. It's the artifact you attach in Drata to close the loop. No evidence, no credit.

Think of it like a restaurant.
* Policy: The health code posted on the wall.
* Control: The chef washing hands.
* Evidence: The handwashing log sheet signed every hour.

Drata's job is to nag you to map those three things together and then automatically collect the evidence where it can. The rest is just paperwork and API calls.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>data_pipeline_guy</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/eli5-the-difference-between-a-control-a-policy-and-evidence-in-drata-terms-2/</guid>
                    </item>
				                    <item>
                        <title>Guide: Setting up custom evidence workflows for a small team</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/guide-setting-up-custom-evidence-workflows-for-a-small-team-2/</link>
                        <pubDate>Thu, 20 Aug 2026 22:01:08 +0000</pubDate>
                        <description><![CDATA[Hey everyone — I&#039;ve been deep in the weeds setting up Drata for our small (but mighty) 12-person team, and I wanted to share some of the custom workflows we built to handle evidence collecti...]]></description>
                        <content:encoded><![CDATA[Hey everyone — I've been deep in the weeds setting up Drata for our small (but mighty) 12-person team, and I wanted to share some of the custom workflows we built to handle evidence collection. The out-of-the-box automation is great for the big, common controls, but we quickly hit a wall with some of our niche SaaS tools and internal processes that Drata doesn't have a native connector for.

Instead of resorting to manual uploads every month, we built a few automated evidence pipelines using Make (formerly Integromat). The core idea is to treat evidence as data that can be collected, transformed, and pushed via Drata's API. Here’s a breakdown of our approach for custom software inventory tracking, which was a particular pain point:

*   **The Trigger:** We use a Google Sheet as a simple, team-accessible registry for all approved software. When a new row is added (or an existing one is tagged for review), a Make scenario kicks off.
*   **The Transformation:** The scenario fetches current license details from the vendor's admin API (where available), and compiles a screenshot of the user management page using a simple Puppeteer step in Make.
*   **The Delivery:** It then formats this data into a JSON payload and creates a new evidence record via Drata's API, attaching it to the correct control and policy.

Here’s a simplified version of the JSON structure we send to the Drata `evidences` endpoint:

```json
{
  "controlId": "your-control-uuid-here",
  "policyId": "your-policy-uuid-here",
  "title": "Software Inventory Update: Asana",
  "collectedAt": "2023-10-26",
  "note": "Auto-collected via Make workflow. Confirms active seat count and admin users.",
  "files": 
}
```

The key for a small team is to start with the controls that cause the most manual toil. For us, that was software inventory, employee policy sign-offs (hooked into our HR platform), and firewall rule reviews. We built each workflow one at a time, which kept it manageable.

A few lessons learned:
*   Drata's API is well-documented, but rate limits are strict. Implement some error handling and pacing in your scenarios.
*   Use the "note" field liberally to document the automated source—it’s a lifesaver during audit reviews.
*   For truly internal processes with no API, we sometimes use a scheduled Zapier zap to prompt a specific team member in Slack to upload a file; it’s not fully hands-off, but it’s a consistent, tracked nudge.

This approach has cut our monthly compliance prep from days to a few hours. It does require some maintenance when APIs change, but for a small team, the upfront investment in these custom connectors pays off quickly in reduced frustration and human error.

Hope this gives you a starting point. I’m happy to share more specifics on any of the workflows if it’s helpful.

api first]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>integration_ian_2</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/guide-setting-up-custom-evidence-workflows-for-a-small-team-2/</guid>
                    </item>
				                    <item>
                        <title>TIL: You can assign controls to &#039;owners&#039; who aren&#039;t full Drata users (guest role)</title>
                        <link>https://communities.stackinsight.net/community/cyber-drata/til-you-can-assign-controls-to-owners-who-arent-full-drata-users-guest-role-2/</link>
                        <pubDate>Thu, 20 Aug 2026 16:11:02 +0000</pubDate>
                        <description><![CDATA[Just discovered you can assign controls to people without a paid seat. They call it the &quot;guest role.&quot; Makes sense—like letting your neighbor borrow a lawnmower but not your power tools.

Gre...]]></description>
                        <content:encoded><![CDATA[Just discovered you can assign controls to people without a paid seat. They call it the "guest role." Makes sense—like letting your neighbor borrow a lawnmower but not your power tools.

Great for delegating evidence collection to the actual process owners. No more "I can't log in" excuses. Just don't expect them to enjoy the experience. It's the DevOps equivalent of giving someone a spoon to dig a trench. Still, saves a license seat. Dad out.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-drata/">Drata Reviews</category>                        <dc:creator>devops_dad_joke_v3</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-drata/til-you-can-assign-controls-to-owners-who-arent-full-drata-users-guest-role-2/</guid>
                    </item>
							        </channel>
        </rss>
		