GRC Import and Vendor Tracking
Overview
Section titled “Overview”This page covers advanced vendor tracking workflows: importing your vendor list from GRC compliance platforms (Vanta, Drata, and SecureFrame) or a CSV file, adding vendor identity records, creating custom vendors, and a full reference of vendor categories.
For an introduction to vendor management, see Vendor Management.
Importing vendors from Vanta, Drata, or SecureFrame
Section titled “Importing vendors from Vanta, Drata, or SecureFrame”If your organization uses Vanta, Drata, or SecureFrame for compliance management, you can bulk-import your existing vendor list into Fencer rather than tracking vendors one by one.
Prerequisites
Section titled “Prerequisites”- A connected Vanta, Drata, or SecureFrame integration in your Fencer organization.
- The Administrator role (the
vendors:editability).
Import steps
Section titled “Import steps”- Go to Admin > Vendor Catalog.
- Open the Import menu in the page header.
- Choose your GRC source: Vanta, Drata, or SecureFrame (only connected platforms are listed). Fencer calls the connected integration to fetch your current vendor list, including any risk ratings.
- Review the import preview (see below).
- Click Confirm import to apply the changes.
Import preview
Section titled “Import preview”Before committing, Fencer shows how many vendors came From GRC and groups them into:
- New matches — vendors found in the global Fencer catalog by name, with a Confidence of High (the names match exactly) or Medium (a close match). These are listed with the GRC name and the catalog match they will be linked to.
- Already tracked — vendors you are already tracking in Fencer. They are skipped, though a risk rating from your GRC platform updates the tracked vendor’s risk.
- Unmatched — vendors from your GRC platform that could not be matched to any catalog entry. Fencer creates these as custom vendor entries scoped to your organization.
- Archived — vendors archived in the GRC platform that you already track in Fencer from that source. Confirming the import untracks them. If archiving is the only change, the button reads Untrack archived vendors.
What happens on confirmation
Section titled “What happens on confirmation”- Matched vendors are linked to their corresponding global catalog entries and added to your organization’s tracked vendor list.
- Fencer creates unmatched vendors as custom vendor entries scoped to your organization, using the name from your GRC platform.
- Imported vendors take the risk rating from your GRC platform, are owned by you, and are marked with a source of GRC (Vanta), GRC (Drata), or GRC (SecureFrame) depending on which platform they were imported from.
- Archived GRC vendors are not imported. If a vendor you already track was imported from that GRC platform and is now archived there, Fencer untracks it.
- Fencer shows a summary: how many vendors were imported and already tracked, and how many risk ratings were updated and archived vendors untracked.
Importing vendors from a CSV file
Section titled “Importing vendors from a CSV file”To import a vendor list from a spreadsheet, choose Import > CSV file. The file needs a header row with a name column and a domain column:
| Column | Accepted header names | Required |
|---|---|---|
| Name | name, vendor_name, vendor, or company | Yes |
| Domain | domain, website, website_domain, or url | Yes |
| Risk | risk, risk_level, or risk_rating | No |
Fencer matches each row to the catalog by name or domain and shows a preview of New matches, Already tracked, Unmatched, and Skipped rows. Unmatched rows are created as custom vendors; rows without a domain are skipped. Click Confirm import to add them. Vendors imported from a CSV are tracked with source Manual, so you can untrack them like any vendor you added by hand. An import handles up to 500 vendors at a time.
Adding vendor identities
Section titled “Adding vendor identities”To record which of your users have accounts at a tracked vendor without an integration, add them on
the Vendor Identities tab of Posture > Identities: Add Identity for a single account,
or Import CSV for a file with vendor, email, display_name, username, role, status,
type, and owner columns (UTF-8, up to 5 MB and 10,000 rows). Rows that match an existing
identity for the vendor update it; other rows create new identities. Vendors managed by an
integration get their identities from the integration’s sync instead. For the full column reference,
see Vendor Identities and Syncing.
Custom vendor creation
Section titled “Custom vendor creation”If a vendor is not in the global Fencer catalog, you can create a custom vendor entry scoped to your organization.
- Go to Admin > Vendor Catalog and click Add Vendor.
- Enter the Vendor name — the vendor’s company or product name (required).
- Enter the Website URL — the vendor’s primary website (required).
- Optionally add Notes for additional context, such as how your team uses the vendor or who manages the relationship.
- Click Add vendor.
Fencer checks the name and website domain against the global catalog and your organization’s custom vendors. If a match is found, the form tells you that the vendor already exists in the catalog or is already in your inventory, so you can track the existing entry instead. Custom vendors are scoped to your organization, do not appear in the global catalog for other organizations, and are tracked as soon as you create them, with you as the owner.
Vendor categories reference
Section titled “Vendor categories reference”All vendors in the Fencer catalog are assigned to one of the following categories. Custom vendors are placed in Other.
| Category | Examples of vendors in this category |
|---|---|
| Productivity | Google Workspace, Notion, Confluence |
| Engineering | GitHub, GitLab, Bitbucket, Azure DevOps |
| Design | Figma, Sketch, Adobe Creative Cloud |
| Security | Fencer, CrowdStrike, Snyk |
| HR | Rippling, Workday, Lattice |
| Finance | Brex, Xero, Stripe |
| Sales | Salesforce, HubSpot, Outreach |
| Marketing | Mailchimp, Marketo, SendGrid |
| IT | Iru (Kandji), Jamf, ServiceNow |
| Cloud Infrastructure | Amazon Web Services (AWS), Google Cloud Platform (GCP), Azure |
| Communication | Slack, Zoom, Microsoft Teams |
| Project Management | Linear, Jira, Asana |
| DevOps | Datadog, PagerDuty, CircleCI |
| Data & Analytics | Snowflake, dbt, Looker |
| Customer Support | Zendesk, Intercom, Freshdesk |
| Identity & Access | Okta, Auth0, OneLogin |
| Compliance | Vanta, Drata, SecureFrame |
| Other | Vendors that do not fit the above categories |
Integrated vendors
Section titled “Integrated vendors”Vendors connected through an active Fencer integration (e.g., GitHub, Slack, AWS) are tracked automatically with source Integration. They can’t be untracked by hand; disconnecting the integration untracks them, and their identities come from the integration’s sync.
Examples
Section titled “Examples”Importing from Vanta
Section titled “Importing from Vanta”You have a connected Vanta integration and 50 vendors listed in your Vanta vendor register. Go to Admin > Vendor Catalog and choose Import > Vanta. Fencer fetches the list and shows the preview: 38 new matches, 7 unmatched, and 5 already tracked. You review the unmatched entries — all are niche internal tools not in the global catalog — and click Confirm import. All 45 new vendors are now tracked: 38 linked to catalog entries and 7 created as custom vendors, all with source GRC (Vanta).
Creating a custom vendor
Section titled “Creating a custom vendor”Your company uses an internal tool called “Acme Dashboard” not in the Fencer catalog. Click Add
Vendor, enter the name “Acme Dashboard” and the website https://acme.example.com, and add a
note: “Internal analytics dashboard managed by the data team.” Fencer finds no match in the catalog
and creates the custom entry. It now appears on the In Use tab under the Other category.
Adding vendor identities
Section titled “Adding vendor identities”Export user data from your vendor’s admin console as a CSV. Rename columns to match the Fencer
format (vendor, email, display_name, role, status) and fill the vendor column with the
vendor’s name as it appears in your catalog. On the Vendor Identities tab, click Import CSV,
upload the file, review the preview, and confirm. Fencer creates identity records for all valid
rows.
Troubleshooting
Section titled “Troubleshooting”- Import preview shows medium-confidence matches — Review them carefully before confirming. Fencer matches on the vendor name; if the name in your GRC platform differs from the catalog name, the match is marked Medium.
- The Import menu doesn’t list your GRC platform — only connected Vanta, Drata, and SecureFrame integrations appear. Connect the integration first.
- “CSV is missing a domain column” — add a
domain,website,website_domain, orurlcolumn to your vendor CSV. - Vendor identity CSV fails with an encoding error — Ensure the file is saved as UTF-8.
Spreadsheet applications may default to other encodings. In Excel, use Save As and choose
CSV UTF-8 (Comma delimited). - Vendor identity CSV exceeds the row limit — Split your file into chunks of 10,000 rows or fewer and upload each chunk separately.
- Custom vendor creation rejected as duplicate — A vendor with the same name or website domain already exists in the catalog or your custom vendors. Search for it and track the existing entry.
- GRC-imported vendor cannot be untracked — You cannot individually remove vendors imported from Vanta, Drata, or SecureFrame. Archive the vendor in the GRC platform, then re-run the GRC import to untrack it in Fencer.