💡 Still using the classic Drata experience? Refer to Vendor Directory & Profiles for the original UI.
The Vendors area centralizes third-party vendor management in Drata so you can track vendor security posture, review status, and supporting evidence.
Understand the Vendors area
Vendors includes multiple pages for different workflows:
Vendor insights: Dashboard-level overview (active vendors, reviews due/overdue, risk and impact breakdowns)
Current vendors: Vendors you actively work with
Prospective vendors: Vendors under evaluation before onboarding
Vendor risks: Risks associated with vendors
Criteria: Evaluation criteria used in vendor reviews
Vendor settings: Defaults for reminders, recurring reviews, and vendor-facing email settings
This article focuses on managing vendors in Current vendors.
Access Current vendors
Select Vendors → Current vendors. From Current vendors, you can:
Filter vendors by fields such as Status, Type, Impact level, Overall risk, Security review status, Next review deadline, Business unit, and Security owner
Search vendors by name
Download the vendor list for audit review
Add a single vendor
Select Add vendor.
Enter vendor details.
Upload supporting documentation as needed (for example, a security policy or SOC report).
Save your changes.
Overall risk levels
Use risk levels to reflect how vendor failure or compromise would impact your organization:
High: The vendor stores or can access sensitive data, or the business is highly dependent on the vendor’s services.
Moderate: The vendor has limited access to sensitive data, or service loss would be disruptive.
Low: The vendor does not access sensitive data and service loss would not be disruptive.
Add or Update Vendors in Bulk
If you manage many vendors, you can upload them in bulk using a CSV file. Bulk upload becomes available after at least one vendor exists in your directory.
Go to Vendors → Current vendors
Select Add vendor → Add / update in bulk
Download the CSV template
Enter vendor details in the template
Save the file as a CSV
Upload the CSV and select Next
Review the summary of changes and finalize the upload
Bulk upload behavior
Vendors with the same name or website URL are updated.
Blank fields do not overwrite existing values.
Bulk upload does not include certain impact assessment fields, but it does include Impact level.Archive, restore, or delete a vendor
Bulk Upload Field Requirements (Reference)
Your CSV must include all required and optional column headers.
Optional fields do not require values, but the column header must still be present in the file.
Valid URL Format
URL fields accept either:
A domain name (for example,
drata.comorwww.example.com)A full URL (for example,
https://example.com/page)
Do not use backslashes (\) or incomplete values (for example, example).
Supported Vendor Fields
Field name | Acceptable value |
Name (Required) | Open text |
Website URL (Optional) | URL |
Privacy URL (Optional) | URL |
Terms Of Use URL (Optional) | URL |
Provided Services (Optional) | Open text |
Risk (Optional) |
|
Impact Level (Optional) |
|
Type (Optional) |
|
Status (Optional) |
|
Annual Contract Value (Optional) |
|
Additional Notes | Open text |
Subprocessor (Optional) |
|
Subprocessor Data Location (Optional) | Open text |
Integrations | Vendor name within your Vendor directory. |
Business Unit (Optional) |
|
Stores PII (Optional) |
|
Stored Data (Optional) | Open text |
Vendor Relationship Contact (Optional) |
|
Security Owner (Optional) |
|
Contact at Vendor (Optional) | Open text |
Contact’s Email (Optional) | Valid email address |
Password Policy (Optional) |
|
Password Requires Minimum Length (Optional) |
|
Password Minimum Length (Optional) |
|
Password Requires Number (Optional) |
|
Password Requires Symbol (Optional) |
|
Password Two-Factor Authentication Enable Enabled (Optional) |
|
Upload Vendors with Custom Fields
If your account uses custom vendor fields, they are included in bulk uploads.
Custom field type | Acceptable value |
Currency | Number (with or without decimals) |
Number | Number |
Dropdown | Valid dropdown option |
Short Answer | Open text (max 191 characters) |
Long Answer | Open text (max 30,000 characters) |
If a required custom field contains an invalid value, the vendor will not be added. Invalid values for optional custom fields are ignored.
Archive a vendor
Archive vendors you no longer work with but want to retain for audit history.
Open the vendor profile.
Select the ellipsis (⋯).
Select Archive vendor.
Restore a vendor
Open Vendors → Current vendors.
Filter by Status → Archived.
Select the vendor.
Select the ellipsis (⋯).
Select Restore vendor.
Delete a vendor
⚠️ This action cannot be undone.
Delete vendors only if they were added in error.
Open the vendor profile.
Select the ellipsis (⋯).
Select Delete vendor and confirm.