Fix controls

Work through control gaps from a single menu with live counts. Pick a gap, answer one question, and confirm one previewed batch before anything changes.

PluginAreaAccess
drata-grc-skillsCompliance & Audit ReadinessWrite

Purpose

  • Offers one flat menu: nothing mapped, missing a policy, evidence not current, tests failing, key information missing.
  • Previews every change as a batch and waits for your confirmation.
  • Creates controls and maps requirements, policies and tests on request.

Access: This skill can change your Drata data: create / update control, and create / update evidence when the gap you pick is an evidence gap. Every change is previewed and confirmed before it is applied.

MCP tools used

MCP toolLevelOAuth scope
Get CompanyReadread:company
Search ControlsReadread:controls
List RequirementsReadread:framework
List PoliciesReadread:policy
Create ControlWritecreate:control
Update ControlWriteupdate:control
List EvidenceoptionalReadread:evidence
Create EvidenceoptionalWritecreate:evidence
Update EvidenceoptionalWriteupdate:evidence
Search Monitoring TestsoptionalReadread:monitor-test
This skill uses every scope above that is not marked optional; without them it fails partway through. The 4 marked optional (read:evidence, create:evidence, update:evidence, read:monitor-test) are not required — the skill degrades cleanly without them. What any tool returns is bounded by your Drata role as well as the scope — see MCP Server setup.

Run it

Copy
Copied
/plugin marketplace add drata/drata-claude-plugin
/plugin install drata-grc-skills@drata

Then run the skill by name:

Copy
Copied
/drata-grc-skills:drata-control-resolve-gaps

Or ask for it in your own words:

  • "fix my controls"
  • "assign an owner"
  • "map this control to CC6.1"

Before you start

  • Connect the Drata MCP server. See MCP Server setup.
  • Your MCP OAuth configuration must grant the scopes behind the tools listed above.

Related skills

  • Controls needing work — Two worklists over your not-ready controls — the ones with nothing mapped, and the ones whose manual evidence is out of date — plus any control missing an owner or a description.