Account inventory is the complete list of user, service, and machine accounts across an environment. In IAM and NHI governance, it identifies where each account exists, who or what owns it, its privileges, and whether it is active, dormant, or orphaned, supporting access review, risk reduction, and control enforcement.
What Account Inventory Covers in IAM and NHI Governance
Account inventory is more than a list of logins. It is the authoritative register of human, service, and machine accounts, plus the ownership, purpose, and privilege context needed to understand whether each account is still justified.
In practice, inventory becomes the bridge between access administration and governance. It lets teams distinguish active accounts from dormant or orphaned ones, identify shared or overbroad access, and spot accounts that no longer map cleanly to a business owner or technical system.
Why Account Inventory Matters for Security Control
A good inventory reduces blind spots. Without it, organisations cannot reliably answer basic questions such as which accounts exist, which ones have elevated permissions, and which ones should be reviewed, rotated, disabled, or removed.
That matters because unmanaged accounts often become the easiest path to control failure. Dormant accounts can be reactivated without notice, orphaned accounts can survive staff or system changes, and machine accounts can quietly persist with access that no one is actively watching.
Account inventory also supports privilege reduction. Once accounts are visible in one place, reviewers can compare actual use against intended purpose and trim standing access that no longer matches the account’s role.
How Account Inventory Supports Review, Ownership, and Lifecycle Control
Account inventory is most useful when it records the fields needed for action, not just existence. Ownership, account type, privilege level, last activity, credential status, and review date all help determine whether the account is still valid and who should act on it.
This makes inventory a lifecycle control as much as a discovery control. A current register supports joiner-mover-leaver processes, recurring access reviews, deprovisioning, and exception handling for accounts that must remain active for business or technical reasons.
For service and machine accounts, the same logic applies but the review questions change. Teams need to know what system uses the account, whether the account is tied to automation or integration, and whether its privileges still match the workload it serves.
Common Gaps in Account Inventory Programs
The most common weakness is partial visibility. Many organisations can inventory users in one directory while missing local accounts, application-specific accounts, cloud service principals, automation accounts, or legacy accounts created outside normal governance.
Another common gap is stale metadata. An inventory that exists but is not refreshed will still miss the risk of orphaned ownership, expired purpose, or privileges that no longer reflect current operations. That turns the register into a record of history rather than a control tool.
Definitions also vary across environments, so the inventory must be consistent about what counts as an account, how shared access is represented, and what qualifies as active, dormant, or orphaned.
Risk and Threat Considerations
Account inventory gaps create direct exposure because attackers frequently look for forgotten, unowned, or overprivileged accounts that are less likely to be monitored or disabled. The same weakness also increases the chance of accidental access retention after role changes, system migrations, or decommissioning.
Failure mechanism: Missing or outdated inventory allows orphaned, dormant, shared, or service account to remain active with privileges that no one is systematically reviewing, which weakens detection and control enforcement.
Impact: Untracked accounts can expand the blast radius of compromise, obscure accountability during investigations, and leave organisations unable to prove that access was removed when it should have been.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Defines account lifecycle oversight, including creation, monitoring, disabling, and review. |
| IA-5 — Authenticator Management | Applies where inventory tracks account credentials, rotation status, and shared authenticator risk. | |
| IA-9 — Service Identification and Authentication | Applies to service and machine accounts that authenticate non-human workloads and integrations. | |
| Recommendation — Use AC-2 to require complete account records, periodic review, and timely disabling of unused accounts. Use IA-5 to track and manage authenticators tied to each account and remove stale or shared credentials. Use IA-9 to inventory non-human accounts that authenticate between systems and verify their continued need. | ||
| CIS Controls v8 | CIS-5 — Account Management | Covers control of account lifecycle, privileged accounts, and review of account use. |
| CIS-6 — Access Control Management | Supports least-privilege review and removal of unnecessary access tied to inventoried accounts. | |
| Recommendation — Apply CIS-5 to maintain an authoritative account register and review unused or overprivileged accounts. Use CIS-6 to align account access to current business need and revoke excess privileges. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Addresses management of identities and associated lifecycle controls across the environment. |
| A.5.18 — Access rights | Covers allocation, review, and removal of access rights tied to listed accounts. | |
| Recommendation — Apply A.5.16 to keep the account register current and ensure each identity has a defined owner. Use A.5.18 to review account privileges and remove access that is no longer justified. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Relates to accounts that remain active after ownership or workload changes. |
| NHI-05 — Overprivileged NHI | Directly addresses service and machine accounts whose privileges exceed their purpose. | |
| NHI-09 — NHI Reuse | Covers shared or reused non-human accounts that are hard to govern and attribute. | |
| Recommendation — Use NHI-01 to detect and remove non-human accounts that should have been offboarded. Use NHI-05 to identify inventoried accounts with excess privilege and reduce their access. Use NHI-09 to flag reused accounts and replace them with distinct, attributable identities. | ||
Practitioner Guidance
Why practitioners should care: Treat account inventory as a control plane for access governance, not as an administrative spreadsheet. If the inventory is incomplete, every review, attestation, and deprovisioning decision built on it is less trustworthy.
What to watch for: Pay close attention to accounts without clear ownership, accounts that have not been used within a reasonable period, and accounts whose privilege level no longer matches the system or business process they support.
Practitioner takeaway: The strongest inventory is the one that can drive action, because it connects each account to an owner, a purpose, and a review outcome.