Drata

Active, privately held.

Sources 1, 2, 3, 4 · checked 2026-11-08

• ISO 42001 framework: maps ISO 42001 requirements to a control library, links AI-specific risks to controls, owners, and evidence, and continuously monitors ISO 42001 controls
• NIST AI RMF framework support for identifying, mitigating, and continuously monitoring AI risks
• AI governance: discovery of AI agents running in the customer environment
• Centralized evidence collection, policy version history, and continuous control monitoring

Sources 1, 2, 3, 4 · checked 2026-11-08

• Companies on Drata for SOC 2 or ISO 27001 that are adding ISO 42001 or NIST AI RMF
• Teams that need AI agent discovery alongside control monitoring

Sources 1, 2, 3, 4 · checked 2026-11-08

Contact vendor (plans page lists Foundation, Advanced, and Enterprise tiers without prices)

Sources 1, 2, 3, 4 · checked 2026-11-08

• SOC 2 Type 2
• ISO/IEC 27001:2022
• ISO/IEC 42001:2023
• GDPR (listed in Trust Center compliance section)
• HIPAA (listed in Trust Center compliance section)

Trust Center also lists SOC 3, ISO/IEC 27017, ISO/IEC 27018, and CCPA.

Listed as stated by the vendor. Scope can differ by product or subsidiary; request current reports.

Sources 1, 2, 3, 4 · checked 2026-11-08

• No public pricing
• Foundation plan is limited to SOC 2, ISO 27001, Cyber Essentials, HIPAA, and GDPR; ISO 42001 needs Advanced (any available framework) or an add-on, so confirm which plan you need
• No EU AI Act framework named on the product pages checked; ask about EU AI Act mapping

Sources 1, 2, 3, 4 · checked 2026-11-08