Security reviews allow you to evaluate, document, and track a vendor's security posture over time. Reviews live on the vendor profile and can include questionnaires, SOC reports, uploaded evidence, and a final security decision.

Use security reviews to:

On the Current vendors page, the table includes two key columns that help you track review health across vendors:

You can filter vendors using either column.

To manage security reviews:

Each vendor profile contains a full history of completed and in-progress reviews.

To begin a new review:

A security review allows you to collect evidence and document your assessment.

During a security review, you can:

After reviewing the vendor's documentation and questionnaire responses, select a final decision based on your organization's risk and onboarding requirements:

Add notes to document the reason for your decision, including any required follow-up actions or conditions.

After completion, you can:

SOC report reviews are used to formally review and document SOC reports. To start a SOC report review:

Note: You cannot start a new SOC report review until the current one is completed or deleted.

If a review was completed outside Drata:

The uploaded report is stored with the vendor's review history for audit purposes.

Recurring reviews help ensure vendors are reviewed on a regular cadence.

Scheduled questionnaires are sent automatically on the review window start date.

To maintain a consistent review schedule, Drata may automatically adjust the next review deadline when a review is completed close to its existing due date.

If a review is completed within 90 days of the current deadline, Drata calculates the next deadline based on the original schedule, not the date the review was completed. This prevents deadline drift and keeps recurring reviews aligned to their intended cadence.

For example:

Because the review was completed within 90 days of the deadline, Drata sets the next deadline to December 25 (six months from the original deadline), not December 10. This ensures your review cycle remains consistent over time.

You can automatically remind vendors to complete questionnaires.

To configure reminders:

With Drata, you can conduct security reviews for your vendors from their profile's Security Reviews tab. Learn how to:

To learn how to create and edit security questionnaires, customize the email template, or send and track responses, go to Vendor Security Questionnaire.

On the Current tab of the Vendors page, there is a table that showcases all current vendors. This table contains two important columns: Security review status and Next review deadline.

These columns display the state or status of vendors. You can also filter based on these statuses.

Security review status column overview:

Next review deadline column overview:

After sending out a questionnaire, you can schedule reminder emails to be automatically sent to your vendors, prompting them to complete their questionnaires.

For vendors with recurring reviews, you can set up a schedule to automatically send them your questionnaires.

If your Security Review deadline falls within 90 days of your review completion date, the deadline will be automatically adjusted based on your review frequency, if you have a recurring review frequency set up.

For example, if you complete a review on June 10th with a June 25th deadline and a 6-month review frequency, the new deadline is December 25th (6 months from the original deadline).

If you have a review report completed outside of Drata, you can select the Upload review report to upload and store it in the vendor's profile.