The Vendors area centralizes third-party vendor management in Drata so you can track vendor security posture, review status, and supporting evidence.

Vendors includes multiple pages for different workflows:

This article focuses on managing vendors in Current vendors.

Select Vendors → Current vendors. From Current vendors, you can:

Use risk levels to reflect how vendor failure or compromise would impact your organization:

If you manage many vendors, you can upload them in bulk using a CSV file. Bulk upload becomes available after at least one vendor exists in your directory.

Your CSV must include all required and optional column headers. Optional fields do not require values, but the column header must still be present in the file.

URL fields accept either:

Do not use backslashes (\) or incomplete values (for example, example).

If your account uses custom vendor fields, they are included in bulk uploads.

If a required custom field contains an invalid value, the vendor will not be added. Invalid values for optional custom fields are ignored.

Archive vendors you no longer work with but want to retain for audit history.

⚠️ This action cannot be undone.

Delete vendors only if they were added in error.

The Vendor Directory allows you to track all vendors you work with and their security posture.

Vendor Management is a security subsection that may be examined during your SOC 2 audit. Specifically, Drata addresses the control for maintaining a vendor directory including agreements specifying terms, conditions and responsibilities as well as compliance reports.

In the left navigation within Drata, select Vendors.

On the Vendors page, you can view the list of your vendors with the following details: vendor names, business units, risk levels, status, password policy, type, person responsible for security/compliance within the company, and reminder indicator. You can enable reminders to periodically review vendor information.

You have two ways to add a vendor. You can add a single or multiple vendors at a time.

Note: The Bulk Upload option only becomes available after you have added at least one vendor to your directory. If this is your first time setting up vendors, add a single vendor first before attempting to bulk upload.

Your CSV must include all required and optional column headers. Fields marked as optional do not require a value, but the column header must still be present in the file.

Note about URL Fields:

Note: Ensure you have the custom fields feature. To learn more about custom fields, go to the Custom fields overview help article.

Custom fields added to Vendors are included in the bulk upload. The following table showcases the acceptable value for each custom field type.

If the value of a required custom field does not match the acceptable value, vendors will not be added. If the value of an optional custom field does not match the acceptable value, those fields will be ignored.

Once you've entered your details, save your file as a CSV, upload your file, and select Next.

A warning message is displayed if a required field is not included or does not match the requirements above. Resolve the error and re-upload. The field will be empty after uploading if the values for an optional field do not follow the acceptable value requirement. For example, if Risk is entered as "Medium" instead of "Moderate", the Risk value will be empty since "Medium" is not a recognized value in our system.

After you continue, you will see a step that confirms the summary of changes in your file.

To update vendors, add the vendor name and URL as they exist in the directory into your CSV. Enter any information into the fields you would like to change. If a field is left blank, it will not be updated to an empty state; only fields with differing input values will be updated.

Once you select Continue, you will see a step that confirms a summary of changes, including the number of fields that will be updated.

The summary of changes modal showcases any vendors that are excluded and the reason for the exclusion.

Once you finalize, a confirmation notifies you when the vendors are ready.

After updating or uploading, on the Vendor Directory page, you will see your recently uploaded and updated vendors at the top of the Directory with a blue line indication.

After refreshing the page, the vendors will be sorted into the default alphabetical order and the blue line will not be displayed.

There are three fields in the Vendor drawer where you can add the contact of a personnel or vendor. Here is how we define the responsibilities:

You may archive a vendor if you no longer work with them but want to retain a record of their compliance and risk data for your company. To do so, select the vendor profile, select the ellipse and select Archive Vendor.

You may restore a vendor if you enter in a new agreement with them, or want this vendor to be shown to your auditor. To do so, navigate to the Vendors page, select Archived within the All Statuses filter. You may need to scroll down to select the Archived option.

Select the desired archived vendor, then select the ellipse and then Restore Vendor.

You may delete a vendor if you make a mistake or wish to erase a vendor and its associated data. To do so, select the vendor profile, select the ellipse and select Delete Vendor. You will see a modal where you can confirm or cancel this action.