Checkpoint vs Drata
Drata is a compliance automation platform with plans for growing and enterprise organisations. Checkpoint keeps your compliance records in your own Microsoft 365 tenant, publishes its prices in Australian dollars, and covers the Australian frameworks. Here is how they differ, from each vendor’s own published information.
| Drata | Checkpoint | |
|---|---|---|
| Where your records live | In Drata’s cloud platform. We could not find a published hosting region on Drata’s website; check with Drata. | SharePoint lists in your own Microsoft 365 tenant. Compliance365 has no database holding your registers. |
| Pricing | Not published. Plans are Foundation, Advanced and Enterprise; Foundation is listed for up to 50 staff and one pre-mapped framework. | Published: from $7,000 a year per framework (AUD, ex GST), SOC 2 from $8,999. Enterprise from $14,999. |
| Trying it | Request a demo. | A public demo of the real console with sample data, no sign-up, and a 7-day free trial. |
| Evidence from your systems | A broad set of integrations across cloud, identity, HR and developer tools. | 49 checks read from Microsoft Graph with delegated, read-only permissions. Optional collectors for AWS (10 checks) and GitHub (7 checks). Fewer integrations than Drata beyond these. |
| Australian frameworks | Check Drata’s current framework list for Essential Eight, CPS 234 and IS18. | Essential Eight, IS18, RFFR, CPS 234, DISP / IRAP and the Privacy Act, alongside ISO 27001, SOC 2, ISO 42001, ISO 27701 and NIST CSF. |
| People | Software. Your auditor is engaged separately. | Run it yourself, or get it at no extra cost in a fixed-price Compliance365 consulting engagement. |
What we say about Drata comes from its own published information, checked October 2026: Drata: Plans. Products change, so check the current details with Drata. Something out of date? Tell us and we will correct it.
Drata may suit you better if
- You need integrations with many tools outside Microsoft 365.
- You also need US frameworks such as HIPAA, which Drata lists and Checkpoint does not cover.
Checkpoint suits you if
- You run on Microsoft 365 and want your records in your own tenant, not a vendor’s.
- You need Australian frameworks such as Essential Eight, IS18, RFFR or CPS 234.
- You want published prices and the option of a consultant using the same tool.
Questions
- Is Checkpoint a GRC platform like Drata?
- It does the same job of running the compliance programme and collecting evidence. The difference is where it runs: Checkpoint is a web app that stores everything in your own Microsoft 365, not in a vendor database.
- Does Checkpoint work for SOC 2?
- Yes. It carries the full Trust Services Criteria and prepares the evidence a CPA firm tests.
- What if we are not on Microsoft 365?
- Checkpoint needs Microsoft 365, because that is where it stores your records. If you are not on Microsoft 365, a platform like Drata is the better fit.
