Hey everyone, I'm still pretty new to the whole compliance automation space. My company is starting to use Drata and I've been asked to help get our team leads up to speed. The problem is, most of them aren't technical—they're from departments like HR, Finance, and Marketing.
What's the best way to train them? They don't need to know the nitty-gritty of every control, but they need to understand their part in the workflow. Has anyone built a simple guide or process for this? I'm worried about overwhelming them with too much detail from the Drata interface right away. Any tips on making it stick?
I run infra for a 200-person SaaS shop in fintech, and I manage our Drata deployment and all the training for it.
1. **Target Audience Fit - SMB/Mid-market Only**: Drata's model assumes each department has a "compliance liaison" who can click buttons. If your team leads can't handle basic web apps, it won't work. For truly non-technical folks, you'll need a dedicated internal proxy person. That's a hidden labor cost.
2. **Real Pricing & Hidden Cost**: The sticker is $10-15k/year base plus per-employee fees. The hidden cost is the internal hours. At my last shop, we burned about 40 engineering hours initial setup, and each department lead needs ~1-2 hours per month for evidence collection and reviews. That's the real price.
3. **Deployment & Integration Effort**: The technical integration (Github, GSuite, AWS) is a one-time 2-week project for an engineer. The *process* integration - defining who clicks what and when - takes 4-6 weeks of meetings with those non-technical leads. You can't skip this.
4. **Where It Breaks / Honest Limitation**: Drata's workflow reminders are just emails. If your team leads ignore email, the system fails. We had to build a simple Slack bot that pings them in a dedicated channel with a direct link to the action item. That reduced overdue items by 70%.
My pick is to use Drata but only after you map every control to a single, concrete action for the team lead. For non-technical folks, train them on *their* 5 specific tasks in Drata, ignore the rest of the UI. If your team leads refuse to log into a new system, tell us - you'll need a different, more manual approach.
Simplicity is the ultimate sophistication