Drata Scorecard

Score by criterion

• Framework coverage15% of total

  5/5

  All ten frameworks in our matrix have their own page on drata.com.

  Level 5: All of level 3, plus three or more of ISO 42001, NIST CSF, NIST 800-53, FedRAMP or CMMC.

• Automated evidence20% of total

  4/5

  Drata describes its catalog as 'hundreds of tools' without a number, so we scored the 200 to 299 band. A public API and custom connections are documented.

  Level 4: 200 to 299 published integrations, continuous tests, and a public API or custom integration builder.

• Audit path15% of total

  2/5

  An Audit Hub where auditors work on evidence. A named audit partner network was not confirmed on the pages we read.

  Level 2: A named partner network of audit firms, or auditors can review evidence inside the platform.

• Pricing transparency10% of total

  1/5

  Three plan names (Foundation, Advanced, Enterprise), no dollar figures.

  Level 1: Plan names and inclusions are published, with no numbers.

• Trust and questionnaires10% of total

  4/5

  A trust center built on the SafeBase acquisition, plus AI questionnaire assistance.

  Level 4: Both, with AI-assisted questionnaire answering.

• Vendor risk management10% of total

  4/5

  Third-party risk management that pulls vendor trust center documents and runs assessments.

  Level 4: All of level 3, plus automated review of vendor security documents.

• Customisation10% of total

  4/5

  Custom frameworks (an add-on on Advanced, included on Enterprise) and no-code custom tests.

  Level 4: Custom frameworks, plus custom automated tests.

• User sentiment10% of total

  5/5

  4.7 out of 5 from 1,395 reviews on G2. Drata's own trust center page quotes 4.8, and we used the G2 listing.

  Level 5: Average 4.5 or higher with 200 or more reviews.