[hmahncke]

In principle, a company’s security policy could be to enforce security settings on employee computers with an agent like Drata, and contractually guarantee those same settings for contractors. The evidence during the audit would be the Drata report for employee computers and the signed contracts for the contractors.