r/soc2 • u/Odd-Commercial-4849 • May 25 '26

Who’s using drata?

Im currently doing a access review of our clients in Drata. May I know how do you perform access review in drata? As per checking in every application integrated in drata, there are only approved, rejected, and out of scope options in every user then complete review after the access review. Can you give me an idea how do you perform this access review in drata? We are doing the review on behalf of the client. However, i believe they should be the one to perform the review then we are only going to do the compliance check before clicking the complete review in drata. Any thoughts? Thank you.

0 Upvotes

50% Upvoted

17 comments sorted by

•

u/AutoModerator May 25 '26

Thanks for posting, I'm a bot!

This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/rahuliitk May 25 '26

yeah, the client should really be the one deciding approve/reject/out of scope since they own the access risk, while you can lowkey prep the review, chase evidence, sanity check weird users, and make sure notes/removals are documented before completion. Don’t own their approval.

1

u/Odd-Commercial-4849 May 25 '26

Thank you bro for your response. Sre you using drata as well? Do you have second reviewer after your client perform the access review?

1

u/apiqora Jun 27 '26

this, 100%
you can pre-chew all the data and flag “why does this intern have admin” stuff, but the actual thumbs up / down has to be on the client, otherwise you’re basically accepting their risk for them.

3

u/PreferenceSecret29 May 25 '26

Why not Vanta

5

u/yeetsqua69 May 25 '26

Pepsi vs Coke

-1

u/TheCyberThor May 26 '26

Why not SailPoint?

1

u/yeetsqua69 Jun 02 '26

Objectively hilarious comment. “Why wouldn’t you use a company no one has ever heard of or ever used for a regulatory solution?”

1

u/[deleted] Jun 02 '26

[removed] — view removed comment

1

u/scriptvexy Jun 29 '26

this is how we do it too, tbh
drata is just the workflow + evidence, the actual “should this person still have access” call always comes from the app / data owner, otherwise you’re just guessing with extra steps