Custom Fields for Framework Requirements

Custom Fields are now available directly on framework requirements (both Drata out-of-the-box frameworks and custom frameworks), so you can attach rich metadata—like implementation statements, ownership, or scoring—right where the work happens.

Why It Matters

• Avoids duplicating requirements into custom frameworks solely to store additional data.

• Keeps structured rationale and scoping decisions tied to each requirement for better audit readiness.

• Helps scale complex or highly regulated frameworks (for example, NIST, NYDFS, ISO, custom frameworks) with metadata that matches your real program.

What’s New

Customers can now:

• Add configurable Custom Fields directly to framework requirements (OOTB and custom).

• Capture requirement-level context such as:

  • Implementation statements

  • Scores / ratings

  • Justifications

  • Internal owners and other metadata

• Search, filter, and display custom fields in the requirements table for any framework.

• Apply custom fields to:

  • Specific frameworks, or

  • All frameworks (depending on how the field is scoped).

Callouts & Notes

• Custom Fields for framework requirements are still created and managed in Settings → Fields and Formulas; “Framework Requirement” is a supported object type.

• For Drata OOTB frameworks, customers can only edit the Custom Fields they’ve created, not the underlying Drata requirement fields.

• For custom frameworks, customers can edit all native requirement fields plus any custom fields.

Learn more in the Custom Fields Overview help article.