Book a demo

Constant vs Drata for Essential Eight Compliance

Constant and Drata both support cyber security compliance, but they take different approaches. This page compares their Essential Eight capabilities, evidence collection, assessor involvement, Australian operations, integrations, reporting, and pricing based on publicly available information.

Last reviewed: Sources linked below

A factual comparison

Constant

Constant is an Australian compliance platform designed around continuous evidence collection, AI-assisted pre-review, and certified assessor review. It supports Essential Eight alongside additional security and compliance frameworks.

Drata

Drata is a global trust management platform that maps Essential Eight to controls, evidence, ownership, monitoring, workflows, and Trust Center reporting.

The primary difference

The primary difference is that Constant is Australian-owned and includes certified assessor review in the workflow. Drata is positioned as a broader global trust and compliance automation platform.

At a glance

Six major differences for a quick first read. Detailed comparisons and sources follow.

Capability Constant Drata
Primary focus Continuous compliance and assurance 3 Global trust management and compliance automation 7
Essential Eight Supported 1 Supported 7
Automated evidence collection Automated where connected 3 Automated evidence and tests 7
Certified assessor review Certified assessor review included 2 Not publicly stated
Australian operations Designed and operated in Australia 4 Sydney office 9
Published pricing Public pricing planner 5 Personalised quote; no public figure 10
✓ Verified in published information – Not publicly stated × Explicitly not offered or a different function

Essential Eight and assurance

Framework coverage is different from having a person review whether the evidence supports the claimed maturity level.

Capability Constant Drata
Essential Eight Supported 1 Supported 7
Maturity assessment ML1, ML2, and ML3 1 Maturity-level controls and gap views 7
Certified assessor review Certified assessor review included 2 Not publicly stated
Ongoing reassessment Continuous reassessment workflow 1 Continuous control observation 7
ASD Essentials Included in the price with Essential 8 6 , 5 Not publicly stated

Evidence and automation

This separates connected collection and automated checks from uploaded evidence and final assessment judgement.

Capability Constant Drata
Automated evidence collection Automated where connected 3 Automated evidence and tests 7
Microsoft integrations Supported Microsoft security tooling 1 Integration-specific coverage not detailed on E8 page 7
Evidence uploads Manual upload where not connected 3 Uploaded evidence for non-monitored controls 8
AI evidence review AI pre-review, then assessor review 2 AI is broader platform positioning; E8 use not detailed 11
Continuous monitoring Live posture and gap visibility 3 Continuous control monitoring 7
Evidence history Evidence linked to the assessed record 3 Evidence retained for reviews 7

Compliance management

Planning, ownership, risk, and framework breadth shape how the platform supports work after the first assessment.

Capability Constant Drata
Control owners Control and remediation owners 3 Control ownership 7
Planner, tasks and due dates Built-in planner, tasks, and due dates 3 Tasks, reviews, and custom workflows 7
Reporting On-demand, scheduled, customisable 3 Dashboards and reports 7
Risk management Structured risk assessments 3 Risk linked to Essential Eight controls 7
Multiple frameworks Essential 8 and additional frameworks 3 Essential Eight in a wider catalogue 7
Framework mapping Framework-specific control workflows 3 Control-centric framework mapping 7

Australian operations

Ownership, operations, data residency, assessors, and support are separate claims and are compared separately.

Capability Constant Drata
Australian ownership Australian-owned by Steltek Pty Ltd 4 US company, not Australian-owned 9
Australian operations Designed and operated in Australia 4 Sydney office 9
Australian data residency Australian data residency 4 Australian customer-data hosting not publicly stated
Onshore assessors Australian assessor review 2 Not publicly stated
Australian support hours Australian business-hours support 3 Australian support hours not publicly stated

Commercial

Published pricing and included services can materially change the cost of reaching a reviewed outcome.

Capability Constant Drata
Published pricing Public pricing planner 5 Personalised quote; no public figure 10
Implementation assistance Clear assessor-written control guidance 3 Workflows and readiness guidance 7
Assessor costs Assessor review included in paid plans 5 Not publicly stated
Target customer Teams that need reviewed compliance outcomes 3 Mid-market and enterprise trust programs 11

Key differences explained

Certified assessor review

Constant includes certified assessor review in the published workflow. Drata prepares controls and evidence for maturity assessments and external reviews, but the pages reviewed do not state that a certified Essential Eight assessor is included.

Evidence automation

Both publish automated evidence and continuous monitoring. Drata also provides examples for evidence that is not automatically monitored. Constant follows evidence collection with AI pre-review and assessor review.

Australian operation

Drata lists a Sydney office but is a US company. Australian customer-data hosting and Australian support hours were not publicly stated on the pages reviewed. Constant publishes Australian ownership, operation, data residency, support, and assessors.

Product philosophy

Constant focuses on practical framework work and reviewed Australian assurance. Drata is a broader trust platform for continuous compliance, risk, controls, workflows, and stakeholder reporting.

Which approach may fit?

Neither approach is presented as universally better. They are designed around different priorities.

Constant may suit organisations looking for

  • Essential Eight assurance with certified assessor review included
  • Australian ownership, operations, data, and support
  • Clear guidance for users collecting evidence
  • A public pricing path and reviewed outcome

Drata may suit organisations looking for

  • Broader global trust management
  • Continuous control monitoring across a larger catalogue
  • Custom workflows and Trust Center reporting
  • Enterprise compliance and risk programs

Methodology and sources

How we compared the platforms

This comparison uses publicly available product documentation, vendor websites, security information, and published pricing paths reviewed on 23 September 2026. Where a capability could not be verified, it is marked “Not publicly stated” rather than treated as unavailable.

  1. 1 Constant: Essential Eight compliance software
  2. 2 Constant: Essential Eight with assessor review
  3. 3 Constant: Platform workflow and features
  4. 4 Constant: Security and Australian operations
  5. 5 Constant: Public pricing planner
  6. 6 Constant: ASD Essentials transition tracker
  7. 7 Drata: Essential Eight compliance automation
  8. 8 Drata: Essential Eight evidence guidance
  9. 9 Drata: About and global offices
  10. 10 Drata: Pricing
  11. 11 Drata: Platform overview

Questions answered

What is the difference between Constant and Drata?

The primary difference is that Constant is Australian-owned and includes certified assessor review in the workflow. Drata is positioned as a broader global trust and compliance automation platform.

Do Constant and Drata support Essential Eight?

Constant supports Essential Eight maturity assessment with evidence, AI pre-review, and certified assessor review. Drata: Supported.

Does Drata include certified Essential Eight assessor review?

Drata does not publicly state that a certified Essential Eight assessor is included in the product. That does not mean assessor services are unavailable separately. Constant includes certified assessor review in its published paid-plan workflow.

Can Constant automatically collect Essential Eight evidence?

Yes. Constant collects evidence automatically where a supported integration is connected. Teams can upload evidence where a connector is not used. AI pre-reviews either source before a certified assessor reviews the result.

Where does Constant store Australian customer data?

Constant publishes Australian data residency and says the platform is designed, owned, and operated in Australia by Steltek Pty Ltd.

Does Constant support ASD Essentials?

ASD Essentials is included in the price with Essential 8. Constant continues to assess Essential Eight until ASD publishes requirements that can be implemented and assessed, and the transition tracker is updated as official information is released.

Is Constant a GRC platform?

Constant supports compliance and risk workflows, but its published focus is continuous evidence and reviewed compliance outcomes. It combines framework guidance, evidence, remediation, AI pre-review, certified assessor review, and reporting in one workflow.

How does Constant use AI differently from Drata?

Constant uses AI specifically for evidence pre-review before assessor review. Drata positions AI across its wider trust platform, while its public Essential Eight page focuses on controls, evidence, monitoring, and workflows.

Related comparisons

Comparisons

Factual comparisons of Constant with other Essential Eight approaches.

Constant vs Vanta

Australian Essential Eight assurance compared with global compliance automation.

Evidence collection

Automated Essential Eight evidence collection, plus upload where needed.

Continuous compliance

Continuous compliance software for Australian organisations.

Start your compliance journey today

Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.

Ready to simplify your compliance process?

Book a demo and see constant in action.

Book a Demo Explore More

All Paid Plans Include

  • Unlimited human assessor reviews

  • Evidence collection

  • AI-assisted pre-reviews

  • Compliance dashboards

  • Australian business-hours support

  • On-demand reporting

  • Control owners and tasks

  • Evidence uploads

  • Maturity and gap tracking

  • Role-based access controls

  • Framework guidance

  • 5×5 Risk Matrix

  • Australian data residency