Drata is useful software. It is not a substitute for clear scope, named owners, believable policies, and dated evidence.
Spend on the auditor, not the platform. Use templates, scripts, and recurring review notes to build the process first.
Pay for convenience and breadth up front. Worth it if the breadth is real. Wasteful if the core problem is still "we do not know our own process."
The DIY path starts to crack when you need continuous coverage across many systems, many owners, or multiple teams with conflicting habits. If you are not there yet, do not buy future complexity before you have present discipline.
The practical move for small teams: start with the free pack, use it to decide whether your blocker is a missing process or a missing platform, then buy the full toolkit if you want the complete starter system.