Skip to main content

Managing Vendor Procurement

✅ Feature availability: While the Vendors page is included with Core TPRM, some features may require a TPRM add-on. Refer to Vanta Plans and Pricing for details.

Vendor procurement is a part of Third Party Risk Management in Vanta. It brings together vendors discovered by Vanta, requested by your team using an intake form, or created via procurement integrations so you can conduct comprehensive vendor assessments (such as a security assessment) before approving vendors for use.

⚙️ User permissions: Editors and Admins can manage vendors and vendor settings. Learn more

Adding vendors to procurement

On the Vendors page, use the Procurement status to track vendors requiring assessments (such as a security assessment) for procurement. You can add vendors to procurement in the following ways:

Vendor discovery

On the Vendors page, click the Discovery tab. Vanta surfaces discovered vendors based on activity observed through your connected identity providers (IdP) so you can decide whether they should be added to procurement.

Discovered vendors

If you have connected any IdPs on the Integrations page, we can let you know when employees try to authenticate using an SSO login option. Filter discovered vendors by the Needs review status (also called state) and select one of the following actions:

Action

Description

Move to managed vendor

Add the vendor to your vendor list in the Active status.

Move to procurement

Add the vendor to your vendor list in the Procurement status.

Ignore

Keep the vendor in the discovery tab in the Ignored status—you can undo this at any time.

Reject

Keep the vendor in the discovery tab in the Rejected status—you can undo this at any time.

Export list of accounts

Export a list of the users who tried to log in using an IdP connected to Vanta.

Reappearing vendors

When a vendor reappears in the Discovery tab, review it again and decide whether to add it to your vendor list or ignore it—this helps ensure that vendors actively used by your organization don’t go unnoticed over time.

Vendors may reappear as Needs review when:

  • Employees continue to authenticate to the vendor using a connected IdP

  • New authentication activity is detected after a period of inactivity

  • Additional users begin accessing the same vendor.

It’s not possible to delete a vendor from the Discovery tab. As a workaround, you could add the vendor to the Active tab.

Vendor intake form

You can set up an intake form to collect vendor procurement requests directly in Vanta. When someone submits the form, we create the vendor in your vendor list in the Procurement status. Only one intake form is supported per workspace.

Editing the intake form

Customize the form to choose the questions that collect basic information about a vendor. The form supports standard vendor fields and any custom vendor fields configured for your organization. Answers to questions mapped to a vendor field fill in that field on the vendor profile.

To edit the vendor intake form:

  1. Go to Settings.

  2. In the page menu, scroll to Features and select Vendors > Intake form.

  3. Click Edit form.

  4. In the form editor:

    • Customize the text in Form instructions, or leave it blank.

    • Customize the text for the default questions (the name and website questions cannot be deleted).

    • Use the Required toggle to make questions required or optional.

    • Customize the text in Terms and acknowledgments, or use the Visible toggle to turn off this section.

    • Add instructions and select evidence to request in the Upload documents section (you cannot turn off this section).

  5. To add a question, click the + icon:

    • Supported question types: Short text, Long text, Number, Date, Single-select, or Multi-select.

  6. To map a question to a vendor field, click the + icon and select Map to vendor field:

    • Select a vendor field from the drop-down at the top of the question. Each vendor field can map to only one question.

    • You can map to built-in and custom vendor fields.

    • To map to a risk section, select it from the Risk sections group. Risk sections are the groups of risk attributes in your inherent risk rubric. Each risk section can also map to only one question.

  7. Click Save changes.

    • To see how it looks, click Preview form.

    • To make it live, go to the Intake form tab and turn on Enable intake form.
      ​

💡 Tip: Map a question to the Category field so submitters can select from your built-in and custom categories. We use the category to help auto-score the vendor’s inherent risk. Learn more

Sharing the intake form

Sharing with employees

Any logged-in user with the Employee role can access the Vendor intake form in their account navigation. To share with employees:

  1. At the top of the Vendors page, click Edit intake form.

  2. Next to Employee form URL, click Copy link.

Sharing externally

You can share the intake form with external users by adding email addresses or domains to the access list. To share with external users:

  1. At the top of the Vendors page next to the Edit intake form button.

  2. In the Authentication section, add any email addresses or domains you would like to grant access to.

  3. Next to External form URL, click Copy link.

Reviewing form submissions

  • When someone submits the form, a vendor record is created in your vendor list in the Procurement status.

  • Based on how the submitter answers the intake form questions, Vanta automatically assigns an inherent risk score to the vendor using your inherent risk rubric.

  • If the security owner email field was mapped, they'll get a notification about the new request.

  • If the business owner email field was mapped, they'll get notifications on the status of the request.

Procurement integrations

You can connect an integration in Vanta to automatically add vendors in procurement to your vendor list: