⚠️ Select your experience
The steps to complete your Vendor Automated Impact Assessment depend on your interface version. Select a link to skip to the instructions for your version.
Customers who joined Drata on or after Feb 24, 2026 are automatically on the New Experience.
Instructions for the New Experience ⬇️
Automated Impact Assessment helps you determine the potential impact a vendor poses to your organization based on how they interact with your data, operations, and environments. Drata uses this assessment to recommend an Inherent risk and guide appropriate security review actions.
Availability
⚠️ Plan requirement: Automated Impact Assessment is available only to customers on the TPRM Pro plan.
Why impact assessment matters
Impact assessment helps you:
Consistently evaluate vendor risk during onboarding
Prioritize security reviews based on vendor criticality
Support audit requirements for vendor risk classification
Drive downstream workflows such as review scope and risk creation
When impact assessment occurs
Impact assessment is completed when you:
Add a prospective vendor, or
Add a new vendor and choose to assess impact
If the assessment is not completed, the vendor's Inherent risk is marked as Unscored.
Complete an impact assessment
To complete an impact assessment during vendor creation:
Go to Vendors.
Select Prospective vendors or Current vendors.
Select Add vendor.
In the Impact assessment section, select the best-fit options for:
Data accessed or processed
Operational impact
Access to environments
Drata evaluates your selections and displays a recommended Inherent risk.
Recommended vs modified Inherent risk
The recommended Inherent risk is calculated automatically based on your inputs.
You can override this recommendation if needed.
If overridden, the field updates to Modified Inherent risk.
You can revert back to Drata's recommendation at any time.
Operational impact scale
Level | Impact | Description |
None | 1 | No or negligible operational, financial, or reputational impact |
Low | 2 | Limited process disruption, minimal financial or reputational impact |
Normal | 3 | Some reduction in effectiveness, moderate financial or reputational impact |
Important | 4 | Significant disruption to primary processes, measurable financial loss |
Critical | 5 | Loss of mission-critical operations, severe financial and reputational damage |
Inherent risk definitions
Inherent risk | Description |
Insignificant | Minimal loss or damage, no regulatory reporting |
Minor | Minor financial loss, limited reputational impact |
Moderate | Noticeable process disruption and financial loss |
Major | Significant financial loss, regulatory reporting required |
Critical | Severe financial loss, regulatory action, major reputational damage |
Unscored | Impact assessment not completed |
Instructions for the Classic Experience ⬇️
Drata's Automated Impact Analysis helps you determine the impact that your vendor poses to your organization based on their data accessed or processed, their operational impact, and their access to your environments.
Based on the Impact that a vendor poses to your organization, you can decide the necessary security review actions to conduct.
BEFORE DIVING IN
This feature is only available to customers with TPRM Pro.
Set up impact assessment
On your Vendors page, select the "My vendors" tab, "Add vendor" button, and then "Add a single vendor" button.
On the Add Vendor drawer, go to the Impact assessment section. Select the best fit options for "Data accessed or processed", the "Operational impact", and the "Access to environment" for this vendor.
The following table displays the industry definitions for the Operational Impact scale.
Field Options | Impact | Description |
None | 1 |
|
Low | 2 |
|
Normal | 3 |
|
Important | 4 |
|
Critical | 5 |
|
After you complete the selections, there is a recommended impact level which is Drata's recommendation.
This impact level can be changed. If you change the impact level, the field name updates to "Modified Impact level". You can always revert to Drata's recommendation as well.
The following table displays the industry definitions for the Impact Level scale.
The "Unscored" impact level means you did not complete the impact assessment.
Field Options | Impact | Description |
Insignificant | 1 |
|
Minor | 2 |
|
Moderate | 3 |
|
Major | 4 |
|
Critical | 5 |
|
Update impact assessment
You can always adjust the assessment or change the impact level for the existing vendors. Go to the vendor's profile and edit the Impact assessment section.
