Preparing for SOC 2 with Drata

Drata is the most opinionated of the three platforms about how a compliance program should run. That is its strength if you want the operating cadence, and its cost if your controls do not look like the ones it ships with.

Last reviewed 2026-08-27Written by Jacob Masse, TrazTech Inc.

Drata does the same core job as every platform in this category: it connects to your systems, tests configuration continuously against a control set mapped to the Trust Services Criteria, and holds dated evidence for your auditor. What distinguishes it is depth of workflow rather than breadth of integration. It ships a risk library, control ownership per person, and a review cadence, and it expects you to work the way it is built. Reported Canadian cost is roughly $14,000 to $34,000 CAD a year for a small to mid-size team, billed in United States dollars.

Where it earns the fee

Control ownership as a first-class thing. Each control has a named owner who gets the reminder, and the platform tracks whether that person did the thing. Most first audits fail on periodic controls that were nobody's specific job on a specific day. This is the direct answer to that, and the hardest part of the product to replicate in a spreadsheet.

A risk register you do not have to invent. Drata ships a library of prebuilt risk scenarios drawn from the recognised sources, scored on an impact by likelihood matrix. The annual risk assessment is a control most small companies have never done, and starting from a library rather than a blank page turns a week into an afternoon. If you are also heading towards ISO 27001 later, this is the part that carries over most directly.

Continuous configuration testing and personnel evidence. The same core as the others: encryption, access, branch protection, device posture, user lists reconciled against your people. This is table stakes across the category and Drata does it competently.

Audit workflow. A structured handover to the auditor with evidence organised by control rather than by folder, which reduces the number of clarifying emails during fieldwork more than anyone expects.

Where it stops

Scope is yours. No platform decides which products, environments and data stores are inside the audit, and this is the decision that determines everything downstream. A year of clean automated checks against the wrong boundary is a year lost.

Policies are templates, not policies. You get a set to edit. Every cadence in it becomes a control that gets tested, so an unedited set commits you to somebody else's compliance program. The edit pass is a couple of days and it is not optional.

Remediation is engineering work. The platform tells you that production access has no approval trail. Building the approval step into how your team actually grants access is a change to your process, and it is the part that takes four to twelve weeks on a first audit.

The judgement-based evidence stays manual. Access review decisions, vendor assessments, the tabletop, the incident write-ups, training completion and the penetration test with its remediation. Automation covers configuration state and lists. It does not cover anything where a person had to decide something.

It cannot issue your report. Only a licensed CPA firm can. Drata will introduce you to firms in its partner network, which is a shortlist and not a selection process. Compare fees for the same scope on GetSOC2 before accepting the introduction.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

The cost of an opinionated platform

Drata's depth comes with a constraint. It works well when your controls resemble the ones it ships with, and it gets harder when they do not. A company with an unusual deployment model, a compensating control that does not map onto a standard one, or a control set inherited from an earlier framework will spend time bending its program to fit the product rather than the other way round.

For most Canadian SaaS companies that constraint is invisible, because a first SOC 2 against the security criterion is a standard shape. It shows up in exactly two situations: a regulated environment with controls the platform did not anticipate, and a company that already has a mature control set it does not want to renumber.

Reported pricing, converted to CAD

Drata publishes no dollar figure for any of its plans and every quote goes through a sales call. The bands below come from third-party procurement datasets of signed contracts, converted from United States dollars at roughly 1.35.

The disagreement between sources is the useful signal here. When independent datasets of signed contracts report medians that differ by a factor of two for the same product, the number is set in the negotiation rather than on a rate card. Get a competing quote from at least one other platform before you sign, and ask what a two-year term does to the figure. Reported discounts for multi-year commitments run in the 15 to 25 per cent range.

Under thirty people, do not buy it yet

The threshold is around thirty staff and it is the same for all three platforms, because what they replace is manual evidence work and that work scales with people and systems. Below thirty you have one cloud account, one identity provider, a handful of hires and departures a year, and a change population a saved query answers. That is a few hours a month on a routine, against a subscription costing a quarter to a half of your audit fee.

Drata specifically is a harder sell at the low end than the others, because the things it is best at are the things a small team needs least. Control ownership across a named group matters when there is a group. A risk library with hundreds of scenarios is more than a fifteen person company will use. Both become valuable at the point where compliance is somebody's ongoing responsibility rather than a project with an end date.

The case for buying it early is a company that knows ISO 27001 is coming within eighteen months. The risk register and the control ownership model transfer directly, and running the SOC 2 inside the structure that ISO will demand later saves rebuilding it.

Five questions to put to the sales team

What does the renewal look like if we grow through a headcount band?

Pricing is banded, and growth mid-term is the most common reason a renewal quote is a different shape from the first one. Get the next band's figure in writing before you sign.

Which of our systems do you not integrate with?

Ask by name, for every system in your scope. An unintegrated system is a manual evidence stream you were about to stop budgeting for.

What happens to our historical evidence if we leave?

Answers differ by vendor and are rarely on the pricing page. Evidence does not move cleanly between platforms, so the answer determines whether a future switch costs a month.

Which controls does the platform track but not perform?

A good answer names them: access review decisions, vendor reviews, the tabletop, the risk assessment, incident write-ups. A vague answer is the warning.

Can you quote in Canadian dollars?

Often yes if asked, and it removes currency exposure across a multi-year term. Asking also tells you how much room there is in the rest of the quote.

What Canadian buyers should check

Drata is an American company holding your evidence in the United States, so it becomes a subprocessor of yours. Add it to the vendor register you build for the audit, assess it as you would any other vendor, and keep its own SOC 2 report on file. Forgetting to list the compliance platform in your own vendor register is a common and slightly embarrassing finding.

If you hold personal information about people in Quebec, Law 25 requires an assessment before communicating it outside the province, and your evidence store holding user lists and HR records is a transfer. Document the assessment. The shipped policy templates are American and contain nothing about the PIPEDA breach record obligation, the accountability requirement, or Law 25, so use the policy checklist to work out what has to be added.

The position

Drata is the right choice for a Canadian company above thirty people that intends to run compliance as an ongoing operating cadence rather than a project, and especially for one heading towards ISO 27001 after the SOC 2. What you pay for over the cheaper option is workflow depth and the risk library, and both are worth real money once a group of people is involved.

It is the wrong first purchase for a fifteen person company doing one audit against one framework with a deadline. That company should spend the money on remediation or a readiness assessment and run the evidence routine out of the tracker for one cycle. Drata's plans and product detail are at drata.com, and Sprinto is the one to price against it if budget is the constraint.

Common questions