> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Drata

> Bring Drata's framework readiness, failing tests, personnel and device compliance, policies and vendor reviews into Tierity.

## Overview

Drata continuously monitors your controls for SOC 2, ISO 27001, HIPAA and other frameworks. Tierity connects read-only to Drata's public API, syncs every 6 hours, and turns what needs action (failing tests, incomplete offboarding, people without MFA) into findings in the same queue as the rest of your stack.

## Prerequisites

* A Drata admin who can create API keys
* Manage access (or higher) in Tierity

## Credentials required

| Field | Description |
| - | - |
| **API key** | A read-only Drata API key |
| **Region** | Where your Drata account is hosted: US (default), EU or APAC |

## Setup

**1. Create a read-only API key**

In Drata, go to **Settings → API Keys**, create a key with the **All read** scope, and copy it.

**2. Connect in Tierity**

Go to **Config → Integrations → Drata**, enter the key, choose your region, and click **Test connection**. The first sync starts straight away.

## What gets synced

| Data | Details |
| - | - |
| **Frameworks** | Readiness for each framework you've enabled in Drata |
| **Monitoring tests** | Pass and fail status for Drata's automated tests |
| **Controls** | Controls missing an owner or evidence |
| **Personnel** | MFA, device compliance, security training, policy acceptance and offboarding status |
| **Devices** | Compliance of the devices Drata's agent monitors |
| **Policies** | Policies due for renewal |
| **Vendors** | Vendors due for a security review |

## Findings

| Finding | Severity | Raised when |
| - | - | - |
| **Failing test** | From Drata's test priority | A Drata monitoring test fails |
| **Offboarding incomplete** | High | Someone who has left still has open offboarding tasks |
| **People without MFA** | High | People fail Drata's identity MFA check |
| **Non-compliant devices** | Medium | Devices fail Drata's device checks |
| **Security training overdue** | Low | People haven't completed security training |
| **Policies not accepted** | Low | People haven't accepted current policies |
| **Policy renewal overdue** | Low | Policies are past their renewal date |
| **Vendor reviews due** | Low or medium | Vendor reviews are due; medium when a critical vendor is affected |

Findings close on their own when Drata reports the problem fixed. Findings you've accepted or closed are left alone.

## Viewing in Tierity

* The **Drata** page in the sidebar shows framework readiness and tabs for tests, personnel, devices, policies and vendors.
* The **Drata Workbench card** shows readiness for your top frameworks plus failing tests, incomplete offboarding, people without MFA and vendor reviews due.

## Sync schedule

Drata syncs every 6 hours, and straight away when you first connect or click **Test connection**. Self-hosted instances can change the interval with the `DRATA_SYNC_INTERVAL_MINUTES` environment variable.

## Disconnecting

Go to **Config → Integrations → Drata** and click **Disconnect**, then delete the API key in Drata.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.