Ask ten things before signing: what formats the import reads, whether it keeps dates and deciders, how it matches findings, what it does with unmatched rows, whether it can run a trial import, and how you export again later. A vendor who answers vaguely on import is telling you how they treat your history.
Why ask early
Import capability is rarely on a feature sheet, and it is often an afterthought in sales. Yet it decides whether your first month looks like a controlled handover or a pile of rework. You have the most leverage before the contract is signed, so put these in writing then.
The ten questions
- Which import formats do you read? CSV, SARIF, VEX documents, an API, or only your own export? Ask for the documentation page, not a verbal answer.
- Which fields are preserved? Specifically ask about decision, reason, comment, decider, decision date and first detected date.
- Can the import set the original dates and authors? Or does it stamp the import time and the service account?
- How do you match imported rows to findings? By package identifier, version and advisory? Do you use advisory aliases?
- What happens to rows that match nothing? Are they reported, stored, or dropped silently?
- Can we run a trial import first, and undo it? A sandbox or a rollback matters when you find a mapping error.
- Do imported suppressions have expiry? Can we set a review date in bulk?
- How do imported decisions interact with policy? Does a suppressed finding still count in gates and reports?
- What is the volume limit? Rows per file, calls per minute, total records.
- How do we export everything again? The same fields, in an open format, without extra fees or delay.
What good answers look like
| Topic | Reassuring | Worrying |
|---|---|---|
| Formats | Documented, with sample files | "We handle it case by case" |
| Dates | Original dates preserved | Import date replaces them |
| Matching | Explained rules, alias support | A black box |
| Unmatched rows | Reported with reasons | Silently dropped |
| Undo | Documented rollback | "Be careful" |
| Export | Open format, self service | Support ticket required |
Test, do not just ask
Take a sample of 50 of your decisions, including awkward ones with long comments and missing fields. Ask the vendor to import them into a trial tenant. Then read the results yourself. Check that comments came through, dates are right and the unmatched rows are listed.
Put it in the plan
Whatever the vendor says, write the answers into the migration plan and the evaluation notes. If a gap exists, decide who covers it: a sidecar file, a script, or a manual review. Gaps you know about at signing are manageable. Gaps you find at cutover are not.
A note on Safeguard
Safeguard's SBOM and dependency scanning, policies and gates are available to evaluate with a free scan at gold.safeguard.sh/scan. Use the same questions on any vendor, including us.
Try it yourself
Open the demo and look at how a dependency inventory is built from scanned projects. A good import has to land in a structure like this, so use it to picture where your decisions will attach.
Click through it at your own pace, or open it full screen.
Quick check
Is a vendor without import support a dealbreaker?
Not necessarily. It means you carry more of the work yourself, so plan time for scripts and review.
Who should ask these questions?
The person who will run the migration, with someone from compliance if exceptions carry audit weight.
Last reviewed: 19 October 2026.
